WannaCry

What is WannaCry?

By now I’m sure your firm has heard of the WannaCry ransomware attack that has wreaked havoc on computers everywhere over the last week. WannaCry is a unique ransomware that can self-spread to your computer without you even clicking a link. Firms that are running on an unpatched Microsoft operating system, have a high risk of being infected.

Hopefully you have backups of all your files. Backups mean you don’t have to worry about losing access to case files and other important client information. At this point without backups, you may be paying a Bitcoin ransom that ranges between $300 and $500 for this attack. Needless to say, this would not a fun situation to be in.

WannaCry Decryption Tool

Well, there’s a chance that there may be an alternative to paying the ransom. Normally, ransomware erases the encrypting key from your computer so you’re forced to pay. With WannaCry, the prime numbers used to free files is not erased from the computer’s memory.

As a result, WanaKiwi has been developed to unlock encrypted files. This tool attempts to retrieve the two prime numbers needed for decryption from the computer’s memory. The downside however is that WanaKiwi only works on the following operating systems: Windows XP, Windows 7, Windows Vista, and Windows Server 2003 and 2008. Another important thing to note is that the affected computer CANNOT have been rebooted since its initial infection.

While it’s not a guaranteed fix for decrypting your files, WanaKiwi gives hope that there’s a chance of getting your important files back without paying the fee.