In an attempt to understand modern ransomware mechanisms I landed on a blog post about LockBit.

This one is confusing to me since:

  • This ransomware generates a pair of RSA keys on the infected device which is used to encrypt the AES keys used to encrypt files.

  • Then, the private key of that RSA key is encrypted with a public key embedded in the ransomware. That key is unique to each attack/victim.

So... what's the point in having $2$ pairs of RSA keys?

The attacker would have to host a private key per victim anyway so why such a local keypair? Couldn't the public embedded key be used to encrypt the AES keys directly?


1 Answer 1


Then, the private key of that RSA key is encrypted with a public key embedded in the ransomware. That key is unique to each attack/victim.

I think this is where the confusion arises. That's certainly not what the description on the site that you specify cites:

The encryption is based on two algorithms: RSA and AES. First, an RSA session key pair is generated on the infected workstations. This key pair is encrypted using the embedded attacker's public key and saved on the registry SOFTWARE\LockBit\full.

The "embedded attackers public key" is likely a public key which is owned by the attacker and which is embedded in the software. The private key of that key pair is kept somewhere secure by the attacker.

So I think this is just a misunderstanding really. The software could of course contain a whole host of pre-generated public key, but it makes more sense to generate a key pair locally and then send back the encrypted private session key (whenever the victim decides to pay up).

The disadvantage is - of course - that if the victim can somehow retrieve the private key that all is for naught - in the eyes of the attacker. However, if the key pair can be kept in memory and destroyed directly after key pair generation / encryption then the attacker maintains their advantage.

Now to get your data back the victim or the software sends "their" encrypted private key to the attacker, the attacker can decrypt it and send back the plaintext value.

Note that for RSA the RSA private key can be directly encrypted after generation as you'd only need the public key for encryption. An AES key would need to be present during the encryption operations. So having a separate asymmetric key does make sense to the attacker.

  • 1
    $\begingroup$ Thanks it's much clearer, there's one remaining thing though: if thousands of devices from a company are infected, I can't imagine the victim asking to decrypt thousands of private keys manually since according to the code an RSA keypair is generated per device. So... what's the trick? $\endgroup$
    – Ozwel
    Mar 11, 2022 at 22:22
  • 1
    $\begingroup$ I would find it likely that the malware will have some kind of way to automate this. Other than that, the victim doesn't have much of a choice - they could automate it themselves where required. Certainly the server of the attacker will be able to perform this automatically, presuming some kind of key ID's are known (otherwise anybody would be able to decrypt). $\endgroup$
    – Maarten Bodewes
    Mar 11, 2022 at 23:07
  • 1
    $\begingroup$ @Ozwel: based on that section of the question's reference it looks like the Decryptor contains the private key matching the perpetrator's public key. That would make it able to decipher the RSA key of all devices. I have no idea of if that tool is willingly supplied by the perp to the victims (perhaps against payment) or by other actors (e.g. having obtained the perp's private key or Decryptor in some untold way). $\endgroup$
    – fgrieu
    Mar 12, 2022 at 9:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.