  Ransomware is malicious software that is a prominent global cybersecurity
threat. Typically, ransomware encrypts data on a system, rendering the victim
unable to decrypt it without the attacker's private key. Subsequently, victims
often pay a substantial ransom to recover their data, yet some may still incur
damage or loss. This study examines Rhysida ransomware, which caused
significant damage in the second half of 2023, and proposes a decryption
method. Rhysida ransomware employed a secure random number generator to
generate the encryption key and subsequently encrypt the data. However, an
implementation vulnerability existed that enabled us to regenerate the internal
state of the random number generator at the time of infection. We successfully
decrypted the data using the regenerated random number generator. To the best
of our knowledge, this is the first successful decryption of Rhysida
ransomware. We aspire for our work to contribute to mitigating the damage
inflicted by the Rhysida ransomware.
