# US 12,602,476 B2 · Systems and methods for forensic resolution of ransomware attacks > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,602,476 B2 - Document ID: US12602476B2 - Status: Granted - Kind: B2 - Application number: 18/598,012 - Filed: 2024-03-07 - Published: 2025-03-06 - Granted: 2026-04-14 - Earliest claimed: 2023-03-08 - Assignees: Coveware Inc. - Applicants: Coveware Inc. - Inventors: Andreas Haak; Sarah Jane Wolstencroft; Alexander Holdtman; Catherine Stamson; Julia Cox - Web page: https://patentgrep.com/patent/US12602476B2 ## CPC - G06F 21/565: {by checking file integrity} - G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine - G06F 21/54: by adding security routines or objects to programs - G06F 21/552: {involving long-term monitoring or reporting} - G06F 21/554: {involving event detection and direct action} - G06F 21/56: Computer malware detection or handling, e.g. anti-virus arrangements - G06F 21/561: {Virus type analysis} - G06F 21/562: {Static detection} - G06F 21/564: {by virus signature recognition} - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - G06F 21/568: {eliminating virus, restoring damaged files} - G06F 21/57: Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - G06F 21/602: {Providing cryptographic facilities or services} - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - G06F 2221/033: Test or assess software - G06F 2221/034: Test or assess a computer or a system - G06F 2221/2107: File encryption - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Systems and methods for forensic resolution of ransomware attacks are provided. The systems and methods define a platform and functionality for addressing ransom based attacks. According to one aspect, the platform and functionality provides a suite of programs and services that enable verification of “ransomed” files to ensure that they can in fact be recovered. If an attack has compromised the integrity of the underlying data so that it cannot be recovered, paying the ransom is an exercise in futility. Additional aspects provide for rapid collection of data that is targeted and specific and that further enables efficient forensic analysis. Many conventional approaches in this space fail to capture requisite detail and/or fail to provide a methodology for handling the volumes of data required to efficiently and effectively track or resolve such attacks. Further aspects provide actionable intelligence that drives result oriented goals for ransomed data and/or compromised systems. ## Claims ### Claim 1 A system for managing cyberattacks, the system comprising: at least one processor operatively connected to a memory, the at least one processor configured to: instantiate a web based application, the web based application configured to: access a plurality of threat actor tools via a plurality of application programming interfaces (APIs) tailored to respective ones of the threat actor tools, wherein each API of the plurality of APIs is configured to identify regular expressions, patterns, or emulated behaviors within data of a respective threat actor tool, match activity to indicators of compromise (IOC), and capture data from the respective threat actor tool associated with the IOC; leverage the data produced by a threat actor tool in the plurality of threat actor tools; encode the data produced by the threat actor tool in the plurality of threat actor tools as nodes in a directed acyclic graph; and construct decryption parameters for decrypting ransomed files and generate a first file for storing and accessing associated decryption key information, and a second file for storing and accessing ransomware variant(s) specific parameters for executing decryption. ### Claim 2 (depends on 1) The system of claim 1, wherein the at least one processor is configured to: extract encryption key material from the plurality of threat actor tools; and store the encryption key material with an association with an IOC or MITRE resolution. ### Claim 3 (depends on 2) The system of claim 2, wherein the at least one processor is configured to maintain a library of knowledge including identified solutions or remediations and association with respective malware, a respective attack, respective ransomware, or respective threat actor profiles. ### Claim 4 (depends on 3) The system of claim 3, wherein the at least one processor is configured to generate a JavaScript Object Notation (JSON) and DAT format file output to enable confirmation of a presence of extracted keys. ### Claim 5 (depends on 1) The system of claim 1, wherein the at least one processor is configured to: capture a memory dump created via execution of a threat actor tool of the plurality of threat actor tools, and manage execution of the threat actor tool within a controlled environment or through an emulation process in which the threat actor tool is executed. ### Claim 6 (depends on 5) The system of claim 5, wherein the controlled environment or the emulation process in which the threat actor tool is executed enables capture of execution information in the controlled environment or the emulation process. ### Claim 7 (depends on 5) The system of claim 5, wherein the at least one processor is configured to execute subroutines configured to emulate or replicate parsing behavior for a target threat actor tool of the plurality of threat actor tools that the target threat actor tool executes to locate and extract any embedded decryption parameters. ### Claim 8 (depends on 1) The system of claim 1, wherein the at least one processor is configured to enable configuration merging across multiple encryption variants based on providing multiple decryption keys associated with multiple independent ransomware variants in the merged configuration. ### Claim 9 (depends on 1) The system of claim 1, wherein the at least one processor is configured to manage single triage configuration configured to validate an encryption integrity of encrypted files across a plurality of ransomware variants and/or operating system environments. ### Claim 10 A computer implemented method for managing cyberattacks, the method comprising: instantiating, by at least one processor, a web based application, the web based application; and accessing, by the web based application, a plurality of threat actor tools via a plurality of application programming interfaces (APIs) tailored to respective ones of the threat actor tools, wherein each API of the plurality of APIs is configured to: identify regular expressions, patterns, and/or emulated behaviors within output data of a respective threat actor tool; match activity to indicators of compromise (IOC), and capture data from the respective threat actor tool associated with the IOC; leverage the data produced by a threat actor tool in the plurality of threat actor tools; encode the data produced by the threat actor tool as nodes in a directed acyclic graph; and capture parameters for decrypting ransomed files and generate a first file for storing and accessing associated decryption key information, and a second file for storing and accessing ransomware variant(s) specific parameters for executing decryption. ### Claim 11 (depends on 10) The method of claim 10, further comprising: extracting encryption key material from the plurality of threat actor tools; and storing the encryption key material with an association with an IOC or MITRE resolution. ### Claim 12 (depends on 11) The method of claim 11, further comprising maintaining a library of knowledge including identified solutions or remediations and association with respective malware, a respective attack, respective ransomware, or respective threat actor profiles. ### Claim 13 (depends on 12) The method of claim 12, further comprising generating a JavaScript Object Notation (JSON) and DAT format file output to enable confirmation of a presence of extracted keys. ### Claim 14 (depends on 10) The method of claim 10, further comprising: capturing a memory dump created via execution of a threat actor tool of the plurality of threat actor tools; and managing execution of the threat actor tool within a controlled environment or through an emulation process in which the threat actor tool is executed. ### Claim 15 (depends on 14) The method of claim 14, further comprising capturing execution information in the controlled environment or the emulation process via the controlled environment or the emulation process in which the threat actor tool is executed. ### Claim 16 (depends on 14) The method of claim 14, further comprising executing subroutines configured to emulate or replicate parsing behavior for a target threat actor tool of the plurality of threat actor tools that the target threat actor tool executes to locate and extract any embedded decryption parameters. ### Claim 17 (depends on 10) The method of claim 10, further comprising enabling configuration merging across multiple encryption variants based on providing multiple decryption keys associated with multiple independent ransomware variants in the merged configuration. ### Claim 18 (depends on 10) The method of claim 10, further comprising managing single triage configuration files configured to validate an encryption integrity of encrypted files across a plurality of ransomware variants and/or operating system environments.