SK Shieldus senior researcher Cho Hyo-je (left) and lead researcher Lee Hyun-a present their analysis of ArgonWiper at the global security conference “Virus Bulletin 2026 (VB 2026)” held last month in Seville, Spain. Photo courtesy of SK ShieldusSK Shieldus has upgraded its decryption technology for ArgonWiper, a new strain of ransomware that encrypts files and then deletes the originals. By widening the scope of the tool, which restores encrypted data to its original state, the company can now handle malware samples that previously could not be recovered.SK Shieldus said on the 11th that it presented follow-up research on its ArgonWiper decryption technology at Virus Bulletin 2026 (VB2026), an international security conference held last month in Seville, Spain. The presentation covered improvements to the decryption tool along with an analysis of the actual attack process and the attackers’ infrastructure.ArgonWiper is malware that combines the characteristics of ransomware, which encrypts data, and a wiper, which deletes files. It deletes some files, then compresses and encrypts the rest before erasing the originals. If a company’s critical business files are hit, the damage extends beyond data loss to disruption of normal operations.In October last year, SK Shieldus analyzed ArgonWiper’s encryption structure and found a way to recover data without negotiating with the attackers. The company confirmed that some of the information needed for encryption was hard-coded inside the malware and that encrypted files also retained information that could be used for recovery. Based on those findings, it developed and released a decryption tool. The approach is seen as significant because it secured a way to recover compromised data by analyzing the characteristics of the malware itself, rather than paying the ransom demanded by the attackers.The company then analyzed newly discovered ArgonWiper samples and enhanced the decryption function. At VB2026, Cho Hyo-je, a principal researcher at SK Shieldus, and Lee Hyun-ah, a senior researcher, presented the results of the upgrade, which allows the tool to decrypt samples it had not previously supported.The researchers also obtained information that can be used to track the attackers’ activity. They analyzed shared communication data left in different malware executables to trace related server addresses and communication logs. The indicators of compromise (IoC) and attack activity data obtained in the process can be used to detect and respond to similar threats.SK Shieldus plans to apply the findings to its managed detection and response (MDR), security monitoring and incident response services. The aim is to broaden the scope of data recovery support while linking the information gathered during attack analysis to its actual security services.”After analyzing ArgonWiper’s encryption structure and finding a way to recover data without negotiating with the attackers, we have now extended decryption support to additional samples that were discovered later,” an SK Shieldus official said. “We will continue to research new threats and use the information we gather in that process for actual damage recovery and for threat detection and response.”
Click Here For The Original Source.
——————————————————–
