Korean eggheads crack Rhysida ransomware and release free decryptor tool

Researchers in South Korea found an implementation vulnerability in Rhysida ransomware's use of LibTomCrypt's ChaCha20-based CSPRNG (seeded by a 32-bit execution time) that allowed them to regenerate the RNG state, derive per-file AES-256 keys, and produce a working decryptor; KISA is distributing the free recovery tool. The report also notes Rhysida's intermittent partial-file encryption, keys wrapped with a hardcoded RSA public key, its targeting of sectors such as education, healthcare, manufacturing, IT and government, and advises wiping compromised systems even after successful decryption.