TellYouThePass Ransomware Decryption & Data Recovery

TellYouThePass was first publicly reported in March 2019 and became highly active in China from the second half of 2020. Its operating logic differs fundamentally from most families: rather than brute force or phishing, it tracks the public disclosure cadence of high-severity vulnerabilities and mass-deploys automatically against internet-facing servers. Documented exploitation includes EternalBlue (MS17-010), Apache Log4j2 (CVE-2021-44228), Shiro deserialisation, remote code execution in Confluence and ActiveMQ, and the PHP CGI flaw CVE-2024-4577 in June 2024.

The China context matters most. It has repeatedly run large campaigns against vulnerabilities in domestic business software: in December 2022, 360 observed exploitation of a Yonyou NC file-upload flaw and arbitrary code execution via NCInvokerServlet; in May 2023 it attacked Yonyou NC servers again; and in June 2023 it exploited a command-execution flaw in the Chanjet T+ finance system disclosed on 8 June, with 360 observing over a thousand servers under attack between 9 and 12 June. Victims are typically smaller companies exposing ERP, finance or OA systems directly to the internet.

On the 2026 .sorry extension - attribution is contested. From March 2026 a wave of attacks appeared that appends .sorry and drops a ReadMe.md note. AsiaInfo's deep-dive report compared static sample features and behaviour chains and concluded it is "a new variant with a strong association to the TellYouThePass family", and the Solar incident-response report republished on CN-SEC likewise calls it highly homologous with this family's .locked variant. CVERC's advisory of 10 August 2026, by contrast, states plainly that the malware belongs to "Sorry, a ransomware family newly seen in 2026", and BleepingComputer, Censys and researcher Rivitna all treat it as a new standalone operation (registered on ID-Ransomware as SorryGo), while Qi'anxin states outright that sources disagree. This site keeps .sorry on both pages without ruling on attribution. That wave's entry point (cPanel/WHM CVE-2026-41940), its Go-based Linux payload, its plain-text README.md and its Tox-only negotiation differ sharply from the .locked campaigns described here; see the Sorry ransomware page for the response detail.

Extension: .locked (some builds use .locked1). Note that ".locked" is shared by multiple families, so the extension alone does not establish TellYouThePass — the Mallox Linux/ESXi variant also uses it.

Ransom note: README.html (some builds READ_ME.html or READ_ME9.html), dropped into each encrypted directory and rendered as a ransom page in a browser. The demand is usually small, around 0.1 BTC in observed cases — a clear contrast with organised RaaS families.

Intrusion artefacts are the more reliable evidence: web middleware logs (Tomcat, Nginx, IIS) showing bursts of requests against a specific vulnerable path followed by web-shell access; Java or PHP processes spawning cmd, PowerShell or bash; new jsp/php/aspx files under the application directory; database processes terminated before encryption; and multiple companies in the same industry running the same software compromised in one window.

Platforms: Windows and Linux, with the Linux build harvesting SSH keys for lateral movement.

TellYouThePass concentrates almost entirely on exploiting internet-exposed assets: internet-wide fingerprint scanning for targets (specific ERP/OA/finance products, middleware versions, PHP environments); exploitation of a public or in-the-wild vulnerability for code execution; uploading a web shell and loading modules in memory to avoid on-disk detection; reconnaissance and termination of database and security processes; then encryption, with README.html written to disk.

The dangerous property of this family is the time gap. Only one to a few days separate public disclosure from mass deployment — the Chanjet T+ flaw was disclosed on 8 June and large-scale attacks began on the 9th. For organisations whose patching needs approval, testing and a maintenance window, that gap cannot be closed by patching alone; buying time requires reducing exposure — no direct internet mapping for business systems, a WAF, and an access allowlist. The Linux build also harvests SSH keys to move within the segment.

TellYouThePass uses hybrid RSA + AES encryption. 360's analysis of the Chanjet T+ campaign described the implementation concretely: a 16-character random GUID serves as the symmetric key, file contents are encrypted with AES, and the GUID is then encrypted with an RSA public key. Other vendors document RSA-1024 with AES-256. Because the symmetric key is asymmetrically protected and unique per host, algorithm-level recovery is impossible without the attacker's private key.

Encryption and destructive behaviour: database processes and services are terminated first; application directories, database data directories, shared folders and reachable mapped drives are encrypted; README.html is written into every encrypted directory; some builds skip critical system directories so the host still boots; the Linux build harvests SSH keys. Windows builds generally clear shadow copies and restore points, though not always successfully, so check host by host.

On intermittent encryption: public sources give no consistent account of how each build handles large files. Response work must verify empirically — take .mdf, .dbf and .ibd files and large archives, analyse the distribution and stride of encrypted blocks, and only then judge repair feasibility.