These Researchers Want To Save You From Ransomware—For Free

If your PC is ever locked by ransomware, paying up won’t necessarily release your files; in fact, we recommend that you never hand over cash to these scammers.

- Michael Kan

But what should you do? There’s a chance you can save your files without surrendering your wallet or trashing your PC entirely: A group of security researchers routinely examines the latest ransomware strains for flaws in their computer code and develops free tools that can (sometimes) reverse the infection.

Michael Gillespie is among those researchers. He’s a programmer by day, but in his free time he works as a ransomware hunter for the New Zealand-based antivirus firm Emsisoft, a leading provider of ransomware decryptors. Desperate victims frequently reach out to him for help. “I can get anywhere from 50 to 200 people contacting me per day. It’s crazy,” he said in an interview.

FINDING THE BUGS

When a ransomware infection hits your PC, the malicious code encrypts your files and posts a note, demanding you pay up or never see your data again. If you give in, the hackers will (supposedly) send you a decryption key to recover your files—but often don’t follow through. Like any piece of software, though, a ransomware strain can be buggy.

The bugs can happen for a number of reasons: The hacker behind the malicious code may be a newbie. Or the ransomware itself may be an early first version, and has yet to work out all its kinks. If there’s a weakness in the encryption algorithm—the crucial process that will turn your files into gibberish—then a researcher can potentially unravel a ransomware attack and reverse the infection. Gillespie has exploited those vulnerabilities to create an estimated 100 decryptors, which anyone can download for free.