Incident response
Posts with this tag
Posts
-
Reversing the CSC 2026 Ransomware Unlocker: A Fake gdb, a Salt Born in a SIGTRAP Handler, and an Invertible Check
How our team recovered the files a CTF ransomware encrypted at the CSC 2026 finals, by reversing the 4.9 KB unlocker it left behind, finding the salt it computes only inside a SIGTRAP handler, inverting its flag check, and rebuilding its SHA-256 and RC4 key schedule in Python, then restoring 43 files on six hosts from the organisers' inventory with a runbook and two scripts.
