saddytech/lockbit-rescue

This tool helps victims of a specific ransomware attack recover some of their encrypted files without paying the ransom. It targets LockBit 3.0, also known as LockBit Black, which is a well-documented ransomware strain that encrypts files and then demands payment for the decryption key. The recovery is possible because of a flaw in how LockBit 3.0 reuses its encryption key across many files in the same attack batch. Each encrypted file ends with a footer that includes a 128-byte fingerprint tied to the encryption key used for that batch. Files sharing the same fingerprint were all encrypted with the same keystream. If one file in that group had a long original filename, the tool can reconstruct part of the keystream by comparing what the footer should contain (the compressed filename and some fixed fields) against the encrypted bytes actually stored there. That recovered keystream fragment can then be used to decrypt other files in the same group whose footers are small enough to fit within it. In practice this means recovery rates vary a lot: files with short original names like photo1.jpg may not be recoverable at all, while batches containing files with long descriptive names can see 80% or more of the targeted files come back. The README estimates real-world coverage of 5 to 40% across a typical encrypted collection. Running the tool requires Linux and a C compiler. An install script handles building the underlying C decryptor and installing Python dependencies. You point the tool at the folder of encrypted files and an output folder, and it works through everything automatically, grouping files by batch, selecting the best oracle file in each group, recovering the keystream, and writing the decrypted files. A separate verification script then checks each recovered file to confirm the content matches the expected file type. The tool never modifies the original encrypted files: it only reads from the source and writes to the output directory. The README also directs users to the No More Ransom project, where law enforcement agencies publish decryption keys when they seize them, which would allow full recovery if a matching key exists. The full README is longer than what was shown.