Avast secretly gave DoNex ransomware decryptors to victims before crims vanished

Avast discovered a crypto flaw in DoNex ransomware that allowed it to quietly supply decryptors to victims since March and then publish a public decryptor after the group's dark-web page was taken down; DoNex uses CryptGenRandom() to seed ChaCha20 for file encryption with RSA-4096-encrypted symmetric keys and performs full or intermittent encryption depending on file size, and appears to be a succession of low-novelty rebrands (Muse, DarkRace, DoNex) targeting several countries.