How to
Jonathan Crowe
Jun 2016

Ransomware Decryption Tool Finder: Unlock Your Files without Paying Criminals a Cent

Photo by Source


A year ago, researchers were already referring to ransomware as an epidemic in the making. That was before the DOJ confirmed ransomware complaints had doubled in 2015, and that victims had paid over $24 million to cybercriminals.

Little did anyone know, things were just getting started. The latest estimates from the FBI reveal extortionists generated $209 million in ransomware payments in the first three months of this year alone. That's nearly 9x the total from the previous 12 months combined. That kind of growth is staggering. Worse, it's also extremely incentivizing. 

Criminals know a good score when they see it. If something doesn't change to make these attacks more difficult to execute (and less profitable), there's no reason to believe we won't see the number of attacks and the costs continue to soar. 

Ransomware costs skyrocketed to $209 million in Q1 2016, over 9x the total costs from the previous 12 months combined.

Tweet this stat

What makes these stats even more concerning is the full costs and impact of a ransomware attack isn't fully reflected in the ransom. Attacks cause disruption and downtime, loss of business and reputation. 

Of course, if you're an IT or security pro you're the one who has to deal with all that and the immediate brunt of these attacks. You're the one tasked with the stressful (and often thankless) job of responding to, containing, and remediating an infection. 

It's easy to make recommendations from a distance, for the FBI to say pay the ransom or don't pay the ransom. But it's you who has to grapple with the consequences firsthand, and it's up to you to make sure your company has the choice of whether to pay or not in the first place. 

On a mission to stop ransomware

Stopping ransomware has become the mission we all need to rally around. Here at Barkly, we believe the best way of accomplishing that mission is by developing ways of preventing ransomware infection from the start. That's exactly what we've built our endpoint protection to help you do (you can learn more about it and even try it out for free for 60 days here).   

We also realize more and more people have already been hit with ransomware and need help immediately addressing the infection now. That's why we developed a search tool that makes it easy for ransomware victims to find out whether there are decryption tools available that can help them unlock their encrypted files for free. 

We hope you never have to use it, but it's here when you need it, so check it out and bookmark the page:

Ransomware Decryption Tool Finder


Check out our new decryption tool finder here

How it works:

As they're encrypting files, many types of ransomware will change the file extension. Ex: Files encrypted by Locky will have their extensions changed to ".locky". 

By identifying what the new extension your files have been changed to, you can then use this search tool to identify what type of ransomware you've potentially been infected with, and whether or not there is a decryption tool available. 

A few notes & acknowledgments:

New ransomware families and variants are discovered every day (see the chart below from Symantec to get an idea of the recent explosion in new ransomware types). That makes keeping up extremely difficult to do. 


Source: Symantec

We'll do our best to keep the search tool updated, but it's not realistic to imagine it's currently or ever will be comprehensive. That said, if you know of a decryptor tool or ransomware file extension not on the list, let us know and we'll include it!

Special thanks to the security researchers responsible for creating the decryption tools we link to. Developing these tools is hard and time-consuming work. Each of them reflects an impressive amount of personal dedication to helping people fight back. 

A hat-tip and more special thanks to Florian Roth and his fellow contributors for inspiring us to create this tool with their fantastic ransomware overview.

We hope you never have to use this decryption tool finder. That's why we make it a point to share the best ransomware prevention tips every week on this blog.

Jonathan Crowe

Jonathan Crowe

Jonathan covers the latest threats and cybersecurity trends from a practical perspective.


Close the gaps in your security

Stop paying for AV, get the strongest protection instead. See how Barkly blocks attacks that are getting past AV.

See a demo


Stay informed!

Get the latest security news, tips, and trends straight to your inbox.

Stay informed!

Get the latest security news, tips, and trends straight to your inbox.