Encrypted does not
always mean lost.
A-Lab is a forensic laboratory in Dubai. We investigate ransomware incidents and recover databases, backups, virtual machines and enterprise storage. There is no need to contact the attackers.
Rarely "a few files". Usually the whole business.
DATABASESSQL Server, Oracle, PostgreSQL, MySQL
BACKUPSVeeam VBK, BAK, tape, NAS snapshots
FILE SERVERSSMB shares, NAS, RAID arrays
VIRTUAL MACHINESVMware ESXi, Hyper-V, Proxmox
ENTERPRISE STORAGESAN, iSCSI, object storage
The ransom note is the last step, not the first
1 Initial access→2 Foothold→3 Privilege escalation→4 Discovery→5 Lateral movement→6 Data theft→7 Backups destroyed + encryption→8 Extortion
- Stolen VPN credentials are now the leading entry pointClose to half of 2025 incidents started with a valid password
- Attackers are inside for days or weeks before encryptionBackups and hypervisors are located and dealt with first
- Every stage leaves evidence on disk and in memoryThat evidence identifies the encryptor build, which decides the recovery method
Ransomware families active in 2026
Qilin
.qilinMost active worldwide; ESXi encryptorAkira
.akiraVPN appliances without MFALockBit
.lockbitLeaked builder, many imitatorsDragonForce
.dragonforceCartel model, UK retail attacksPlay
.PLAYClosed group, ~900 victimsMedusa
.MEDUSATriple extortion, ESXi payloadsINC Ransom
.INCHealthcare, public sectorClop
.clopMass file-transfer exploitationPhobos / 8Base
.id[..].phobosSMEs via exposed RDPDharma
.id-XXXX.[mail]RDP brute force since 2016Makop
.makopMiddle East and Asia SMEsMallox
.malloxExposed SQL Server accountsSTOP / Djvu
.qazxCracked software, 150 KB encryptionBlackCat
randomDefunct; vanished with a paymentRansomHub
random700+ victims, then collapsedA ransom note is a brand. The encryptor version in front of you is what determines your recovery options.
Contacting the attackers is the weakest option
Contacting the attackers
- Negotiation with an anonymous criminal group
- Payment first, results unknown
- Decryptors are slow, buggy and corrupt large files
- Stolen data leaked or sold regardless
- Nine in ten paying UAE firms attacked again
Forensic recovery at A-Lab
- No contact with the attackers
- Free assessment, fixed quotation
- Purpose-built tools for your encryptor build
- You verify the recovered data first, then pay
- Entry-point report to prevent a repeat
Every ransomware leaves clues. We find the weakness and use it.
IDENTIFYFamily, version, encryption scheme
ANALYSEFile structures, patterns, traces
REVERSEReverse-engineer the implementation
DEVELOPBuild the recovery tool for the case
RECOVERVerified data on clean media
Weak key generation. Reused keys. Partial encryption of large files. Traces in memory and on disk. Ransomware is software written under pressure, and software has bugs. A forensic engineering problem, not a negotiation.
Four steps. No risk to you.
1
Send samplesThe ransom note and two or three encrypted files, on WhatsApp.2
Incident responseFamily identified, recoverability confirmed, timeline and fixed quotation.3
Laboratory recoveryDecryption, database repair, virtual machine and backup reconstruction.4
Verify, then payYou open and test the recovered data first. Payment only on success.- 98% success rate across ransomware recovery cases
- Confidential engagement, NDA on request, white-label for consultancies
Ransomware is an incident.
Data loss is not always the outcome.
+971 52 758 9336
Scan to open WhatsApp. Send the ransom note and encrypted samples for a free assessment. No need to contact the attackers.