CyphrQ
Menu

Ransomware Decryption Tools: What No More Ransom Can and Can't Do

Free ransomware decryptors exist for some families only. What No More Ransom offers, why paying guarantees nothing, and the backups that matter more.

By CyphrQ.ai

Written with AI assistance and human editorial review. Every figure linked to its source.

10 min read

Can you get ransomware-encrypted files back without paying? Sometimes. The No More Ransom project, an initiative of Europol, the Dutch police and security companies, gives away free ransomware decryption tools for named families. A tool exists only where researchers found a flaw or police seized the keys, and paying the criminals doesn't guarantee recovery either. Your own offline backups are the plan that works.

A free decryptor is a lucky break, not a recovery plan. This post explains where decryptors come from, why they exist only for some families, what paying a ransom does and doesn't buy, and the sanctions risk US regulators attach to it. How attackers get to the ransom note in the first place is covered in how ransomware attacks unfold.

What does the No More Ransom project offer ransomware victims?

No More Ransom is a free website. Its About page calls it an initiative by the National High Tech Crime Unit of the Netherlands' police, Europol's European Cybercrime Centre, Kaspersky and McAfee, and says the aim is to help victims "retrieve their encrypted data without having to pay the criminals" (No More Ransom). Other public and private partners can join.

The site has four useful parts:

Part What it does What to know
Decryption Tools A list of free decryptors, each tied to a named ransomware family and the organisation that built it Each tool comes with a how-to guide; many work only on specific versions
Crypto Sheriff Helps you work out which ransomware family encrypted your files Identification comes first, because a decryptor for the wrong family won't help
Prevention Advice Plain guidance on avoiding infection Useful for staff awareness
Report a Crime Links to national police reporting Reporting can matter later, as the sanctions section below explains

On the decryption tools page, as checked on 26 October 2026, the builders included police forces, a national agency and security companies. Two examples:

  • LockBit 3.0 Decryptor, credited to the Japanese police.
  • Hive (v1 to v4) Decryptor, built by KISA, the Korea Internet & Security Agency.

Security companies supply many of the others, among them Avast, Bitdefender, Emsisoft, Kaspersky and Trend Micro (listed alphabetically, not as a recommendation).

The page carries a warning worth repeating: "Make sure you remove the malware from your system first, otherwise it will repeatedly lock your system or encrypt files." It also says: "Before downloading and starting the solution, read the how-to guide." Several entries are limited to particular versions; the GandCrab entry, for example, covers "V1, V4 and V5 up to V5.2 versions".

Download decryptors only from No More Ransom or the named builder's own website. A decryptor offered through a forum post or a search advert is a fresh infection risk.

Why do ransomware decryption tools exist for only some families?

Well-built ransomware uses the same cryptography that protects your bank login. In general terms, each file is encrypted with a random key, and those keys are then locked with a key that only the attacker holds. Without the attacker's key, recovery by brute force isn't practical.

Free decryptors therefore come from two main routes:

  1. The criminals made a mistake. Researchers find a flaw in how a ransomware strain generates, stores or reuses its keys, and build a tool that exploits it. When the gang fixes the flaw, the next version is out of reach. That's why so many listings name specific versions.
  2. Police seized the keys. When law enforcement disrupted LockBit on 20 February 2024, the UK National Crime Agency said it had obtained "over 1,000 decryption keys" (NCA). No More Ransom now lists a LockBit 3.0 tool from the Japanese police.

The joint #StopRansomware Guide (September 2023) from CISA, the FBI, the NSA and MS-ISAC reflects the second route. Its response checklist says to "Consult federal law enforcement, even if mitigation actions are possible, regarding possible decryptors available" (CISA). Police may hold keys that aren't public.

A decryptor also solves only half of a modern incident. Most current gangs steal data before they encrypt it, then threaten to publish it. US Treasury described LockBit's model in exactly those terms, data stolen before systems are encrypted (Treasury, 7 May 2024). Getting your files back does nothing about the copy the attacker holds.

Does paying a ransom guarantee you get your data back?

No. Three official sources say so in different ways:

  • No More Ransom advises against paying, warning that "there's no guarantee you'll get the decryption key you need in return" (No More Ransom).
  • The UK National Crime Agency, after seeing inside LockBit's systems, said "even when a ransom is paid, it does not guarantee that data will be deleted" (NCA).
  • The US government "continues to strongly discourage the payment of cyber ransom or extortion demands", according to the Treasury Department (Treasury, 21 September 2021).

The scale explains the official worry. Treasury said in 2021 that ransomware payments in 2020 "reached over $400 million, more than four times their level in 2019". In 2024 it cited Justice Department figures that LockBit "has targeted over 2,500 victims worldwide" and is "alleged to have received more than $500 million in ransom payments" (Treasury).

Whether to pay is a legal and business decision, made with your lawyers and insurer. If you hold cyber cover, the extortion terms of the policy matter here; what cyber insurance covers walks through them.

What are the sanctions risks of paying a ransomware gang?

For anyone subject to US jurisdiction, paying a ransom can break sanctions law if the money reaches a sanctioned person.

On 21 September 2021, the Office of Foreign Assets Control (OFAC) issued an updated advisory on the sanctions risks of facilitating ransomware payments. Treasury's announcement says victims can receive voluntary self-disclosure credit "in the event a sanctions nexus is later determined", and that prompt reporting and cooperation with law enforcement can earn "significant mitigation related to OFAC enforcement matters" (Treasury). This post quotes Treasury's announcement, not the advisory PDF itself.

In practice: LockBit. On 7 May 2024, OFAC designated Dmitry Yuryevich Khoroshev, whom Treasury describes as the operator behind the "LockBitSupp" persona, under Executive Order 13694 as amended. Treasury says "OFAC's regulations generally prohibit all dealings by U.S. persons" involving his blocked property, and the UK and Australia announced the same designation (Treasury).

The problem for a victim is that a ransom note doesn't tell you who will end up with the money. Outside the US, check your own country's sanctions rules with counsel before any payment decision. Your reporting duties to regulators run on a separate clock; breach notification deadlines by country has those.

Which ransomware controls make a decryptor unnecessary?

The goal is never needing a decryptor. Our ransomware controls post sets out the backup properties that survive an attack; this section adds the points specific to recovery.

  • Offline, encrypted backups and golden images. The CISA guide says to maintain "offline, encrypted backups of critical data", test them in a disaster recovery scenario, and keep updated "golden images" (clean, pre-configured system templates) of critical systems for quick rebuilds (CISA).
  • Immutable storage, configured with care. The same guide adds a caution: "Use immutable storage with caution", because it may not meet some compliance criteria and a misconfiguration can be costly. Decide retention periods before you lock them.
  • Endpoint rollback, verified. Some endpoint security products offer a rollback feature that restores files changed by ransomware. Treat it as a bonus, not a backup. Ask the vendor what the feature relies on, and test it on a lab machine.
  • Keep the evidence. Preserve the ransom note, samples of encrypted files and, if you can, the ransomware program itself. They identify the family, and a decryptor or seized key may appear later.

Going deeper: for security and IT teams

This section is for incident responders and infrastructure leads who would run recovery.

Triage order. Identify the family before anything else: the ransom note's text and contact method, the file extension, and a sample encrypted file. No More Ransom's Crypto Sheriff is built for this step. Record the version where you can, because decryptor coverage is version-specific. Then contain: No More Ransom's own warning is that a decryptor run on a still-infected machine will be undone.

Never decrypt your only copy. Image affected disks first, or at least copy the encrypted data to separate storage. Run any decryptor against a copy, then verify output by opening sample files and, where you have them, comparing hashes against a backup catalogue. A partially failed decryption can corrupt files that a later, better tool could have recovered.

Why some decryptors work. In hybrid encryption, a per-file symmetric key does the bulk work and the attacker's asymmetric public key wraps it. Researchers can only recover files where the implementation breaks that design: predictable key generation, keys left recoverable on the victim's system, or one key reused across victims. When none of those apply, only the attacker's private key, or a seized copy of it, will help. That's why the CISA checklist tells you to ask federal law enforcement about decryptors, not only to search online.

Map recovery to a standard. NIST published IR 8374 Revision 1, Ransomware Risk Management: A Cybersecurity Framework (CSF) 2.0 Community Profile, on 11 June 2026. NIST says it "translates the NIST CSF 2.0 into practical actions" for managing ransomware risk (NIST). Use it to check that your Recover outcomes have named owners, tested procedures and restore-time targets, not just a backup product.

Immutable storage settings to check. Who can shorten or remove a retention lock? Are backup admin credentials separate from domain admin, with phishing-resistant MFA? Does the backup console sit on its own network segment? CISA's caution on misconfiguration applies to each of these.

Endpoint rollback questions. Does rollback depend on local snapshots that ransomware commonly deletes (the shadow-copy deletion described in our ransomware controls post)? Is the rollback cache protected from an attacker with local admin rights? How much change history does it keep on a busy file server?

Sanctions and reporting workflow. If payment is ever on the table, counsel should screen the recipient against OFAC's Specially Designated Nationals (SDN) list and equivalent UK and EU lists, and document the decision. Report early to the FBI or CISA in the US, or your national authority elsewhere. Treasury ties mitigation to prompt reporting and cooperation, and police may hold keys.

Evidence to keep: the ransom note, encrypted samples, the ransomware binary, a memory capture where feasible, firewall and EDR logs for the encryption window, and every communication with the attacker.

Questions for your team:

  • How long would a full restore of our top five systems take, measured, not estimated?
  • Who is authorised to contact law enforcement, and when?
  • Where are our golden images, and when were they last rebuilt?

Key takeaways

  • No More Ransom offers free decryptors, but only for families where researchers found a flaw or police seized keys.
  • Decryptors are often version-specific, and they never undo the theft of your data.
  • Paying is no guarantee: No More Ransom, the UK NCA and US Treasury all say so.
  • For US persons, paying a sanctioned actor such as LockBit's designated leader can be a sanctions violation; prompt reporting earns mitigation.
  • Offline, encrypted, tested backups and golden images are the recovery plan; a decryptor is a bonus.

A checklist for the day files are encrypted

  1. Isolate affected systems, and protect the backups first.
  2. Photograph or save the ransom note; copy sample encrypted files.
  3. Identify the family with No More Ransom's Crypto Sheriff, and note the version.
  4. Check the No More Ransom decryption tools list, and ask law enforcement about keys.
  5. Image disks before running any decryptor, and run it on a copy.
  6. Remove the malware before decrypting anything.
  7. Involve counsel and your insurer before any payment discussion, including a sanctions check.
  8. Restore from offline backups in priority order, and record what worked for next time.

Sources