Makop Ransomware Recovery: .makop Files, RDP Attacks and Database Recovery

Makop has been active since 2020 and is closely related to Phobos; antivirus products often even detect it as Phobos. Its affiliates mainly get in through Remote Desktop exposed to the internet, by guessing or brute-forcing passwords, then stop database and office processes and encrypt the files.

Encrypted files are renamed to the original name plus a random ID, the attacker's e-mail address and .makop, for example invoice.xlsx.[1A2B3C4D].[attacker@mail].makop. Some affiliates use other extensions such as .mkp. The ransom note readme-warning.txt is left on the desktop and in each folder.

There is no public decryptor for Makop. Check No More Ransom for new tools, but do not pay for "Makop decryptors" offered online: they are usually scams. Recovery therefore works from the parts of the files that were not encrypted.

We have recovered Makop cases ourselves. Large files such as SQL Server and Tally databases, accounting data, virtual disks and backups are often only partly encrypted, and the intact parts can be read directly: tables are rebuilt from the surviving database pages, and virtual machines and files from the readable parts of VMDK, VHDX and backup files.

Do not delete the encrypted files or reinstall the server. Copy them, keep the ransom note, and send us a sample for a free assessment. No data, no charge.