source_3933.pdf (2 MB)

FSI responders recovered a major guarantee insurer from a hands-on Gunra ransomware attack after finding that the malware reseeded C's `rand()` inside every key-generation iteration. The error reduced each nominal 256-bit ChaCha20 key to one repeated byte, leaving only 256 candidates despite RSA-4096 wrapping. The team built an LLM-assisted decryptor that handled intermittent and multilayer encryption, validated candidates with entropy and known Oracle headers, and used optimized C and AVX2 to process 100 GB in about 147 seconds. All database servers were restored, with major services returning 81 hours after the attack.