0Apt Ransomware Recovery: What's Recoverable

0Apt, also styled 0Apt Syndicate, appeared on 28 January 2026 and operates as a ransomware-as-a-service running the usual double-extortion model — encrypt the files, and threaten to publish stolen data. It quickly listed more than 190 victims on its leak site. What made it notable is that security researchers (GuidePoint, Halcyon, SOCRadar and others) found almost none of those claims held up — with no genuine stolen data behind them, and some named organisations confirming they had found no compromise at all.

The encryptor itself is real and technically capable, which is why 0Apt is treated as a genuine threat despite the inflated claims. It is written in Rust and uses strong, standard cryptography: a 32-byte AES-256 key with a 16-byte initialization vector to encrypt file contents, and RSA with OAEP padding to protect that key.

It is configurable — exclusion lists, file-size limits, parallel threads — which lets affiliates tune how it runs. Encrypted files get a .0apt extension, and it drops a ransom note, README0apt.txt, carrying a unique victim identifier.

Because so much of 0Apt's victim list was fabricated, a posting on its leak site is not proof of a breach. If your organisation appears there, the first step is verification, not panic: check for the actual signs of an intrusion — encrypted files with the .0apt extension, the README0apt.txt note, unexpected access, data actually leaving the network. Plenty of listed names turned out to have no real incident behind them.

Where the encryption is real, it is strong: AES-256 for the data and RSA for the key, with no published flaw that would allow decryption without the attackers' key. Recovery therefore comes from what the attack did not reach or did not finish — backups on storage the attackers could not get to, hypervisor or array snapshots that survived, and the large database and virtual-disk files that were only partly encrypted and can be rebuilt from their surviving regions.

As always, preserve the encrypted files, the note and the affected systems exactly as they are, and get them assessed before anything is rebuilt or 'cleaned up'.