Sorry Ransomware Decryption & Data Recovery

Sorry is ransomware that broke out in 2026. Written in Go, it targets internet-exposed Linux web servers almost exclusively (whether it counts as a family of its own is disputed - see below), and its scale is tied to one vulnerability: the cPanel / WHM (including DNSOnly) authentication bypass CVE-2026-41940 (CNNVD-202604-5641, CVSS 9.8), exploited as a zero-day from late February 2026 and hit far harder once the patch shipped at the end of April. On 2 May 2026 BleepingComputer reported mass exploitation to deploy the Sorry Linux encryptor, citing Shadowserver figures of at least 44,000 compromised cPanel IP addresses. On 10 August China's National Computer Virus Emergency Response Center (CVERC) issued a national advisory confirming multiple domestic incidents, and on 4 September a cyber-police advisory carried by People's Daily named Sorry and Weax as recently very active, listing manufacturing, trade, healthcare, education and technology victims.

This is an opportunistic, volume-driven operation: internet-wide scanning followed by batch deployment. Small-company websites, web application servers, finance and ERP servers, and cloud instances take the brunt. CVERC notes the payload runs on most mainstream Linux distributions used in China, including domestic (Xinchuang) systems, and spreads on its own - one compromised edge server can become a network-wide event.

Attribution is contested, and this page states both readings. For "a new TellYouThePass variant": AsiaInfo's May 2026 report, titled as a deep analysis of "a new TellYouThePass variant", compared static sample features and behaviour chains and concluded the samples are "a new variant with a strong association to the TellYouThePass family", a position its August report on the Linux wave keeps (detection name Ransom.Linux.YSORR.THEOEBF); a March report by the Solar incident-response team, republished on CN-SEC, likewise calls it "highly homologous" with this family's .locked variant, though without a code-level comparison. For "a separate new family": CVERC's 10 August advisory states plainly that the malware "belongs to Sorry, a ransomware family newly seen in 2026"; BleepingComputer, Censys and ThreatLocker all covered the campaign without linking it to any known family; researcher Rivitna judged it "not HiddenTear, but a new ransomware developed in Go"; and Amigo-A registered it separately on ID-Ransomware as SorryGo (Sorry 2026). Qi'anxin's report simply notes that "some public analyses associate it with TellYouThePass or Phobos, and sources disagree". 360's March advisory offers a third reading again: the tradecraft resembles TellYouThePass while the note format looks closer to WormHole. The practical conclusion: attribution is unsettled, response should not depend on the family label, identification and recovery decisions must come from the sample in hand, and reports to third parties should record both readings.

September 2026: back as .ths. On 28 September 360's anti-ransomware team disclosed a new Sorry variant: the extension changed from .sorry to .ths, the note was renamed hello.txt, and the cipher suite moved from RSA plus AES-GCM to X25519 plus XChaCha20-Poly1305, with the rest of the logic unchanged. The first wave of victims was encrypted overnight on 20-21 September, with thousands of infections and the campaign still running; 360 traced the attack chain to "exploitation of an enterprise remote-access product". Huorong's advisory of 24 September points the entry at SQL injection in systems related to Gnway (金万维): the operators used it to run commands, gain a foothold and then drop the ransomware. The sample 360 published lands at C:\Users\Public\dbg.exe, so this wave hits Windows hosts and is a different build from the Linux cPanel wave that began in May. A 25 September report by the Solar incident-response team says the qTox ID is the same in the old and new notes and reads the variant as Sorry (TellYouThePass family) returning under a new name - "ths" being a common shorthand for TellYouThePass. In 360's September report Sorry ranked third among infections in China at 7.58%.

Separately, a 2018 HiddenTear campaign also appended .sorry and is unrelated to this wave. As of October 2026 Sorry runs no public leak site and offers no automated decryption portal - negotiation is manual over Tox, although the .ths note now states a price of 0.025 BTC per server.

Extension and note. The .sorry suffix is appended to the complete original filename, so order.sql becomes order.sql.sorry. A README.md is written into every encrypted directory carrying a fixed Tox ID and instructing the victim to install qTox. Within a campaign the note is essentially identical for every victim - no per-victim code, no Bitcoin address, no web negotiation portal.

Host-side symptoms, usually noticed before the extension.

• SSH is forcibly stopped (systemctl stop sshd, service ssh stop and two more variants, run through both /bin/bash and /bin/sh to cover different distributions), so the first report is typically "we suddenly cannot SSH into the server".
• Database processes are killed with pkill -9, so the application breaks before anyone notices the files.
• The malicious process masquerades under a common sshd process name.
• Executables named .sorry_ plus eight random characters appear under /tmp, alongside a matching .log file.
• Outbound Tor connections to an .onion address are present.

File structure. Encrypted files carry a fixed-length header holding a magic value, a truncated fragment of the original filename and the RSA-wrapped key block, so they are slightly larger than the originals. The header length varies by build: the August variant reversed by Topsec uses 288 bytes (0x120), while another public analysis of the May cPanel campaign records a roughly 2KB header - so the actual sample decides.

Telling this wave apart from the older TellYouThePass .locked campaigns. Some vendors file this activity as a new TellYouThePass variant, yet the observable differences are substantial. The .locked campaigns ship both Windows and Linux builds, drop README.html or READ_ME.html rendered as a web page, embed a Bitcoin address with a small demand around 0.1 BTC, take contact through self-hosted domain mailboxes or a Tor page, and get in through application-layer flaws in products such as Yonyou NC, Chanjet T+, Log4j2 or PHP CGI. This .sorry wave is a 64-bit Linux ELF written in Go and obfuscated with Garble, drops a plain-text README.md (AsiaInfo records the name as ReadMe.md), carries no payment address and only a fixed Tox ID, and enters through cPanel/WHM CVE-2026-41940 followed by weak-password SSH movement inside the network. Note also that a separate March 2026 wave in China - fileless HTA/VBScript delivery on Windows with shadow-copy deletion, per the Solar and 360 reports - also appended .sorry and is not the same payload as the Linux cPanel wave. Seeing ".sorry" therefore does not by itself make this page's response applicable; establish which payload you are holding first.

The .ths variant (from September 2026). Files get .ths appended to the full original name (license.zip becomes license.zip.ths) and hello.txt is written into every directory - close to a hundred thousand copies on a single host. The note asks 0.025 BTC per server, gives a qTox contact and, if that fails, "suggests" going through a data-recovery company or an online marketplace. Typical first reports are accounting ledgers that will not open, ERP clients that cannot reach the database, and backups and office documents carrying .ths. On the host, check the indicators 360 published: the payload path C:\Users\Public\dbg.exe (72,704 bytes, SHA256 4e93fb51de8f05622b5edff8c6cec9cc8660049157c88ad4f53572e7d4d16c55), with a process claiming to be Microsoft's "Photos Agent Service" while carrying no icon and no digital signature. Do not confuse it with .thx, which researchers attribute to the Dharma family.

Bottom line. The .sorry extension plus a same-directory README.md plus a Tox ID plus a 64-bit Linux ELF payload identifies the Linux wave that began in May; the .ths extension plus hello.txt plus a dbg.exe-style payload on a Windows host identifies the .ths variant that began in September. Be aware that several Chinese data-recovery blog posts describe .sorry as "RDP brute force on Windows with sparse encryption", which contradicts every authoritative sample analysis: all publicly confirmed samples are 64-bit Linux ELF binaries and the encryption is not intermittent. Attribution must come from the actual sample, because it decides whether structural repair is on the table at all.

Initial access. Operators abuse the WebPros cPanel / WHM authorisation bypass CVE-2026-41940 to obtain server administration rights, then drop and run the encryptor with no victim interaction. No phishing and no weak password are needed - only an unpatched control panel facing the internet, which is why it spreads far faster than hands-on-keyboard ransomware.

Environment profiling. The sample builds a unique victim identifier (username, hostname, CPU count, operating system details, active network interfaces) and reports it back over a Tor hidden service.

Clearing the way. Before encryption it stops the SSH service to cut the administrator's remote rescue channel and force-kills database, security and backup services - freeing file handles and sharply narrowing the response window.

Data theft. CVERC lists exfiltration as a distinct stage: business data, configuration files and internal documents are stolen in bulk before encryption. No public leak site has been observed, so what happens to that data afterwards is opaque - "it has not been posted" is not evidence the data is safe.

Lateral movement, the part most often underestimated. Internal SSH services are scanned and brute-forced concurrently with a built-in weak-password dictionary (public analyses do not enumerate the ports, so cover both the standard port and custom ones) (entries such as user@123, 1234 and 2024-2026). On success the payload is uploaded over SFTP into the remote /tmp directory, marked executable and started with nohup, and each newly compromised host repeats the full chain. Response must therefore never stop at the server that was exploited: wherever internal Linux hosts share credentials or use weak ones, the infection walks across them over SSH.

The .ths variant comes in another way. This wave does not use cPanel. 360 describes "exploitation of an enterprise remote-access product", reusing an earlier flaw in a product it names only as "某万维", and Huorong's advisory specifies SQL injection in Gnway-related systems. Small and mid-sized Chinese firms commonly use such remote-access gateways to let remote staff reach finance and ERP systems, so a breach puts the operators right next to the most valuable data. 360 notes that the .ths payload does not spread on its own - the operators deploy it host by host through access they already hold - but it does scan for and encrypt mapped network drives, so file servers and shares can be damaged without being breached directly. Scope the investigation to every host behind the same remote-access gateway.

Engineering quality. The samples are 64-bit Linux ELF binaries written in Go and obfuscated with Garble, with over 99% of symbols destroyed.

Hybrid key scheme. A random symmetric key from Go's crypto/rand is wrapped with an embedded RSA-2048 public key under PKCS#1 v1.5 and written into the file header; the plaintext key exists only briefly in memory. Both the symmetric cipher and the key granularity differ between reported samples: BleepingComputer and researcher Rivitna describe ChaCha20 in the May cPanel campaign builds with a per-victim master key and per-file nonces; the variant Topsec's Alpha Lab captured in August used AES-256-GCM over 64KB chunks with a separate key per file; CVERC's advisory simply says AES. Several build branches most likely exist, but all sources agree on the RSA-2048 outer wrap.

Not intermittent encryption - and this drives recovery strategy. Directories are walked concurrently and any file matching the built-in extension whitelist (84 entries in the variant Topsec reversed) is encrypted in full, streamed rather than partially, with GCM providing block-level integrity checks. That is fundamentally different from partial-encryption families such as Rhysida or LockBit: the ciphertext leaves no intact regions for page-level database extraction, so "repair what intermittent encryption missed" is not available here.

Deliberate destruction of recovery paths. After encryption the sample reopens the original with O_WRONLY and overwrites it with crypto/rand data - 1MB for files under 10MB, 5MB for files of 10MB or more - then forces the write to disk. This is an explicit anti-forensics design.

Platform coverage. Linux has no volume shadow copies to delete, so the same effect is achieved by stopping services and killing processes. The cPanel wave from May used only Linux encryptors; the .ths variant from September is a Windows build. No ESXi encryptor has been verified by authoritative analysis.

How the .ths variant encrypts. The asymmetric layer is now X25519 and the symmetric layer XChaCha20-Poly1305; 360 says the rest matches the earlier version. Before encrypting, the sample checks the network, collects the computer name, username, IP address and processor count, checks for an analysis environment, creates a mutex to avoid running twice, and tries to stop database processes (including MySQL and related services) so database files can be encrypted. Encryption runs in three passes: 28 database extensions first, then 59 document, image and media extensions, then 357 other extensions; ProgramData, the recycle bin, Windows system folders, node_modules and .git are skipped. 360's analysis states plainly that this variant cannot delete volume shadow copies and advises victims to try restoring from them first - which makes shadow copies the first recovery path to check on a .ths host. Because 360 says the rest matches the earlier version, whether the earlier build's random overwrite of source files survives in .ths is not addressed separately in public analysis and has to be checked on the sample.