No More Ransom Project

The No More Ransom project was launched in 2016 by Europol's EC3, the Dutch National Police, McAfee, and Kaspersky as a public-private response to the ransomware epidemic. The project's website at nomoreransom.org provides free decryption keys and tools for ransomware strains where law enforcement or security researchers have been able to break the encryption or seize the criminals' key infrastructure. Victims can upload a sample of their encrypted files and a ransom note to the Crypto Sheriff tool, which identifies the ransomware strain and checks whether a decryptor is available.

The project has grown to include over 180 partners from law enforcement, cybersecurity firms, and government bodies worldwide. It has helped prevent hundreds of millions of euros in ransom payments. New decryptors are added as law enforcement operations dismantle ransomware groups; following Operation Duck Hunt against Qakbot and actions against REvil and LockBit variants, decryptors for multiple strains were added to the platform.

For consumers affected by ransomware, the recommended approach is: do not pay the ransom (it funds further crime and does not guarantee file recovery); report the incident to your national cybercrime reporting body (Action Fraud in the UK, IC3 in the US, etc.); check nomoreransom.org for a free decryptor; and, if no decryptor is available, preserve encrypted files in case one becomes available in future. Paying the ransom is not advised, as it may also place you on a list of confirmed payers targeted for repeat extortion.