How do I identify which ransomware infected my system?

Upload a ransom note and a sample encrypted file (not containing sensitive data) to ID Ransomware (id-ransomware.malwarehunterteam.com) or use the Crypto Sheriff tool on nomoreransom.org. These tools match your files against a database of known ransomware families. You can also manually identify ransomware by searching for the encrypted file extension (e.g., .locky, .cerber, .stop) and the ransom note filename (e.g., _readme.txt, HOW_TO_DECRYPT.html) in ransomware identification databases. Accurate identification is critical because using the wrong decryptor can corrupt your files permanently.

Are free ransomware decryption tools safe to use?

Free decryption tools from the No More Ransom Project (nomoreransom.org), Emsisoft, Kaspersky, Avast, and Trend Micro are safe and legitimate. These are developed by trusted security companies and law-enforcement partners. However, be extremely cautious of decryption tools found through general web searches. Threat actors have been known to distribute fake decryption tools that are themselves malware. Only download decryptors from the official No More Ransom website, the official websites of the security companies listed on the tool, or verified security-researcher repositories on GitHub.

What should I do if no free decryptor exists for my ransomware?

If no free decryptor is currently available: (1) Preserve forensic copies of encrypted files and all ransom notes, as decryptors may be released in the future. (2) Report the incident to law enforcement (FBI IC3 in the US, Action Fraud in the UK, Europol in the EU) as their investigations may yield decryption keys. (3) Restore from backups if available. (4) Monitor No More Ransom and ID Ransomware for new tool releases. (5) Do not pay the ransom as a first resort. (6) If the business impact is critical and no other option exists, consult with incident-response professionals and legal counsel before considering negotiation.

Free Ransomware Decryption Tools: No More Ransom Project Guide

When ransomware encrypts your files, the attackers want you to believe that paying the ransom is the only way to recover your data. In many cases, it is not. Free decryption tools exist for over 165 ransomware families, and the number grows as law enforcement seizes attacker infrastructure and security researchers crack flawed encryption implementations.

The No More Ransom Project, launched in 2016 by Europol, the Dutch National Police, Kaspersky, and McAfee, has grown into a global initiative with over 170 partners providing free decryption tools. As of 2026, the project has helped over 10 million victims and prevented more than 1.5 billion dollars in ransom payments.

How Free Decryptors Come to Exist

Free decryption tools are not magic. They exist because of specific circumstances that expose the encryption keys or reveal weaknesses in the ransomware's cryptographic implementation:

Law-Enforcement Operations

When law enforcement seizes the attacker's command-and-control infrastructure, they recover the master decryption keys stored on those servers. These keys are then used to build free decryption tools for all victims of that ransomware family.

Hive (2023) — the FBI covertly infiltrated Hive's infrastructure for seven months, obtaining decryption keys and distributing them to over 300 victims, preventing approximately $130M in ransom payments
GandCrab (2019) — a joint operation by Europol, the Romanian Police, and Bitdefender recovered keys enabling decryption for thousands of victims
REvil/Sodinokibi (2021) — law-enforcement operations recovered a universal decryption key after the group's infrastructure was compromised

Cryptographic Weaknesses

Some ransomware developers make mistakes in their encryption implementation that allow researchers to recover keys without the attacker's cooperation:

Weak random-number generation — if the ransomware uses a predictable random-number generator (PRNG) to create encryption keys, researchers can predict the key by analysing the PRNG output. Several early ransomware families used the system clock as a seed, making the key deterministic.
Key stored locally — some ransomware generates the encryption key locally and stores it in memory, in the Windows registry, or in a local file before sending it to the command-and-control server. If the key is recovered before it is deleted, decryption is possible.
Flawed encryption modes — improper use of cipher modes (e.g., ECB mode instead of CBC or CTR) can sometimes allow partial decryption or full key recovery through cryptanalysis.
Key reuse across files — if the same key and IV (initialisation vector) are reused across multiple files, known-plaintext attacks become possible when the original content of any encrypted file is known.

Operator Key Releases

Ransomware operators sometimes voluntarily release decryption keys:

When shutting down operations (retiring or rebranding)
Under law-enforcement pressure
As a public-relations gesture (some operators release keys for healthcare or education victims)
After internal disputes (disgruntled affiliates leaking master keys)

Figure 1 — The five-step ransomware identification and decryption workflow. Always preserve encrypted originals and test on copies before attempting full decryption.

Ransomware Identification Tools

Crypto Sheriff (No More Ransom)

The Crypto Sheriff tool on nomoreransom.org is the primary identification interface. Upload up to two encrypted files and the ransom note, and the tool compares them against a database of known ransomware families. If a match is found, it directs you to the appropriate free decryptor.

ID Ransomware

Developed by Michael Gillespie (MalwareHunterTeam), ID Ransomware at id-ransomware.malwarehunterteam.com identifies over 1,100 ransomware strains. Upload a ransom note, a sample encrypted file, or both. The tool provides:

The ransomware family name and variant
Whether a free decryptor exists
Links to the decryptor if available
Whether decryption is theoretically possible (based on known cryptographic weaknesses)

Manual Identification

If automated tools do not match your ransomware, manual identification uses three artifacts:

Ransom note filename — each ransomware family uses distinctive note filenames: _readme.txt (STOP/Djvu), HOW_TO_DECRYPT.html (various), RECOVER-FILES.txt (various), readme.txt (Dharma variants)
Encrypted file extension — the extension appended to encrypted files is often unique: .cerber, .locky, .ryuk, .conti, .lockbit. Some families use random extensions or modify the original extension.
Ransom note content — the language, formatting, Bitcoin wallet addresses, Tor URLs, and email addresses in the ransom note can identify the operator. Search databases like Ransomware Tracker and Ransomwhere for matching indicators.

Major Decryptable Ransomware Families

STOP/Djvu

The most common ransomware family, responsible for an estimated 70% of all ransomware infections worldwide. Targets individual users through cracked software and game downloads. Extensions include .stop, .djvu, .rumba, .topi, and dozens of others. Emsisoft provides a free decryptor that works for offline-key variants (where the C2 server was unreachable when the encryption occurred). Online-key variants use unique keys per victim and cannot be decrypted without the attacker's server.

Hive

After the FBI's seven-month infiltration, decryption keys for all Hive victims became available. The FBI distributed keys directly to victims and made them available through No More Ransom. This operation is the gold standard for law-enforcement disruption.

GandCrab

Decryptors for GandCrab versions 1 through 5.2 are available through Bitdefender on No More Ransom, covering virtually all GandCrab variants. The decryptor was made possible by a joint operation between Europol, the Romanian Police, and Bitdefender.

REvil/Sodinokibi

A universal decryption key was obtained through law-enforcement operations. Bitdefender released a free decryptor covering variants encrypted before the group's infrastructure takedown in 2021.

Dharma/CrySiS

Master decryption keys were released publicly (reportedly by a disgruntled insider). Kaspersky and Avast provide free decryptors for most Dharma variants, though newer variants post-key-release require separate keys.

Critical Pre-Decryption Steps

Before running any decryption tool, these steps are non-negotiable:

Create a complete forensic image — clone the affected drive(s) bit-for-bit using dd, FTK Imager, or similar forensic imaging tools. This preserves the encrypted state exactly as-is. If decryption fails, you can always return to this state.
Isolate the affected system — disconnect from the network to prevent the ransomware from spreading or re-encrypting. Some ransomware variants re-encrypt files periodically.
Remove the ransomware — boot from a clean USB and scan with updated antimalware tools before attempting decryption. If the ransomware is still running, it may re-encrypt files after decryption.
Identify the exact variant — do not guess. Use Crypto Sheriff or ID Ransomware to confirm the exact family and variant. Using the wrong decryptor can corrupt files irreversibly.
Test on copies first — copy 2-3 encrypted files to a separate location and run the decryptor on those copies. Verify the decrypted output is valid (open the file, check the content). Only proceed to full decryption after successful test.

No More Ransom Project Resources

The No More Ransom website (nomoreransom.org) provides:

Crypto Sheriff — the identification tool that matches your encrypted files against known ransomware families
Decryption Tools page — categorised decryptors searchable by ransomware name, with download links and usage instructions
Prevention advice — guidance on preventing future infections
Reporting tool — direct reporting to law enforcement in your jurisdiction

The project is available in over 37 languages and is supported by law-enforcement agencies, security vendors, and financial institutions worldwide.

Figure 2 — No More Ransom Project impact statistics and major ransomware families with free decryptors available.

When No Free Decryptor Exists

Modern ransomware that uses properly implemented hybrid encryption (RSA-2048/4096 for key exchange + AES-256-CBC/CTR for file encryption) with a secure PRNG and proper key management cannot be broken by current technology. If no decryptor exists for your ransomware variant:

Preserve everything — keep forensic copies of encrypted files, ransom notes, and any system logs. Decryptors may become available months or years later if the operator's infrastructure is seized or their keys are leaked.
Report to law enforcement — FBI IC3 (ic3.gov), CISA (cisa.gov), Action Fraud (UK), Europol (EU). Every report contributes to ongoing investigations that may eventually yield decryption keys.
Restore from backups — this is the primary recovery path when no decryptor exists. If backups are immutable and verified, restoration is straightforward.
Monitor for new decryptors — bookmark nomoreransom.org and id-ransomware.malwarehunterteam.com. Check monthly for updates. Some decryptors have been released years after the initial ransomware campaign.

The existence of free decryption tools reinforces a critical message: paying the ransom is not the only option, and in many cases it is not necessary. Before considering payment, exhaust all legitimate recovery paths: backups, decryption tools, incident-response assistance, and law-enforcement engagement. Every ransom payment funds the next attack. Every successful free decryption weakens the criminal business model.

Free Ransomware Decryption Tools: No More Ransom Project Guide

Key Takeaways