How to Decrypt .rex Files: A Strategic Incident Response and Recovery Guide – 2026 Update

Direct Answer: The .rex## extension identifies a Rex ransomware infection, a derivative of the MedusaLocker family. Its cryptography is sound, and there is no known method to decrypt these files without the attackers’ unique private key.

From an incident response standpoint, encountering a MedusaLocker derivative like Rex signifies a serious breach orchestrated by a professional, well-funded operation. This is not a script-kiddie attack; it’s a calculated assault on your organization’s crown jewels, often with a double-extortion component. Your mindset must shift from seeking a quick technical fix to managing a critical business continuity and data breach crisis. As our Lead Researcher Brent Kenreich notes in his Microsoft exam guides, understanding the underlying Windows service architecture is key to stopping lateral movement—a principle that is absolutely critical when facing an adversary this sophisticated.

Phase 1: CRISIS CONTAINMENT – Halting the Bleeding

Your first objective is to isolate the compromised infrastructure to prevent further encryption and data exfiltration. Assume the attackers have footholds beyond the initially detected machine.

1. Segment Critical Infrastructure: Immediately disconnect all domain controllers, file servers, database servers, and hypervisors (ESXi/Hyper-V) from the general network. Disable VLAN trunking to them temporarily.
2. Disable Remote Access: Shut down all inbound RDP and VPN access except for a single, hardened jumpbox reserved for your incident response team. Force-logoff all active user sessions.
3. Block Outbound C2: Configure firewalls to deny all outbound traffic from suspected subnets, specifically blocking traffic to the actors’ email domains to thwart actor communications.
4. Preserve Volatile Data: On critical, still-running servers, acquire full memory dumps. The unencrypted master key or intermediate cryptographic materials may reside in RAM before being purged.

Phase 2: ANALYSIS – Mapping the Intrusion

Once contained, you must understand how they got in and what they touched. This intelligence dictates your legal obligations and rebuilding strategy.

1. Identify Patient Zero: Scrutinize security logs (firewall, VPN, RDP) around the time of the first file modifications. Common initial access vectors for professional groups like Rex include unpatched VPN gateways, compromised RDP credentials exposed to the internet, or successful spear-phishing campaigns.

The Rex operation shares several behavioral and cryptographic similarities with MedusaLocker campaigns analyzed in our Net ransomware recovery methods guide, particularly regarding lateral movement and double-extortion tactics.

1. Perform Live Memory Acquisition: On representative infected endpoints, capture RAM dumps. Advanced groups load their payloads directly into memory to evade detection. Volatile data holds clues to the command-and-control servers and tools used for lateral movement (e.g., Cobalt Strike, Mimikatz).
2. Audit Privileged Accounts: Review Active Directory logs for anomalous behavior, such as service account creation, additions to high-privilege groups (Domain Admins, Enterprise Admins), or mass password resets.

Phase 3: EXFILRATION AUDIT – Assessing the Double Extortion Threat

Rex, as a MedusaLocker derivative, consistently steals data before encryption. Acknowledging this leak is legally mandatory under GDPR, HIPAA, and other regulations.

1. Review Ransom Note Content: The note explicitly states data was downloaded. This claim must be treated as credible. Cross-reference the directories they may have accessed with your file server directory trees to estimate the volume of stolen data.
2. Analyze Network Logs: Inspect NetFlow or equivalent logs for large, sustained outbound data transfers occurring prior to the encryption event. Look for uploads to services like Mega.nz, Dropbox, or unknown IP ranges.
3. Consult Legal Counsel: Based on the findings, engage your legal team immediately to prepare for regulatory notifications and potential customer outreach requirements. This is not an “if” but a “when” scenario.

Phase 4: RECOVERY OPTIONS – Charting the Path Forward

With containment, analysis, and audit underway, you can now weigh your realistic paths to restoration.

Option	Pros	Cons
Restore from Immutable Backups	Guarantees data integrity; fastest recovery path.	Requires investment in immutable technology; backups must be tested regularly.
Data Breach Validation	Provides legal clarity for reporting; informs stakeholders.	Does not recover data; incurs forensic cost.
Negotiation w/ Actors	Potentially recovers data if backups fail.	Funds illicit activity; no guarantee of key/data deletion; encourages future attacks.
Law Enforcement	May disrupt gang operations; provides official documentation.	Rarely leads to rapid file recovery; may complicate negotiations.

The strongest recommendation is to rebuild your environment from scratch using pristine hardware/software and restore data from verified, air-gapped, or immutable backups. Paying the ransom should be your absolute last resort.

The Ransom Note: A Tactical Breakdown

The actors’ communication is a carefully crafted psychological tool. Here is the complete note, followed by a breakdown of its manipulative tactics.

Your personal ID: -
YOUR COMPANY NETWORK HAS BEEN PENETRATED
ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE WILL PERMANENTLY CORRUPT IT. DO NOT MODIFY ENCRYPTED FILES. DO NOT RENAME ENCRYPTED FILES.
No software available on internet can help you. We are the only ones able to solve your problem. We gathered highly confidential/personal data. These data are currently stored on a private server.
...
Contact us for price and get decryption software.
Email: recovery2@salamati.vip, recovery2@amniyat.xyz
Tor chat address: -
...
IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.

Deconstructing Their Narrative:

• “YOUR COMPANY NETWORK HAS BEEN PENETRATED”: A stark, factual statement designed to induce panic and establish dominance.
• “ANY ATTEMPT TO RESTORE… WILL PERMANENTLY CORRUPT IT”: A direct lie to prevent you from attempting file recovery with independent tools or from backups, forcing you into their controlled process.
• “We gathered highly confidential/personal data”: The core of the double extortion threat. They are explicitly telling you they have your secrets and will use them as leverage.
• “IF YOU DON’T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER”: A classic high-pressure sales tactic to create a false sense of urgency and discourage deliberation.

The Cryptographic Impasse

Rex, as a MedusaLocker derivative, employs a cryptographically sound hybrid system. Per-file data is encrypted using AES-256 in CBC mode. The symmetric key is then wrapped using the actors’ RSA-2048 public key.

Our laboratory’s analysis concludes that no known implementation flaw exists in this Rex variant’s cryptographic construction. The use of a unique, random IV for each file and the robust AES-CBC mode eliminate common attack vectors. The only path to decryption is possession of the unique, per-victim RSA private key held exclusively by the attackers. Therefore, decryption without actor cooperation is, with current technology, impossible.

PowerShell Audit Script for Scope Assessment

Deploy this script to conduct a thorough sweep for Rex-related IOCs across your fleet.

# StopDjvuDecryptor.org Audit Script for Rex (MedusaLocker) Variant
Write-Host "[SCAN] Initiating forensic sweep for Rex (MedusaLocker) IOCs..." -ForegroundColor DarkGreen

# 1. Detect Files with the Variable .rex## Extension
Get-ChildItem -Path C:\ -Recurse -Include "*.rex*" -ErrorAction SilentlyContinue -Depth 3 | 
    Group-Object { $_.Extension } | 
    Where-Object { $_.Count -gt 5 } | 
    ForEach-Object { Write-Host "Potential Rex Cluster Detected: '$($_.Name)' affecting $($_.Count) files." }

# 2. Locate Ransom Notes
Get-ChildItem -Path C:\ -Filter 'RANSOM_NOTE.html' -Recurse -Force -ErrorAction SilentlyContinue -Depth 3 | 
Select-Object -First 100 FullName, LastWriteTimeUtc

# 3. Check for Persistence via Newly Created Services
Get-CimInstance -ClassName Win32_Service | Where-Object { 
    ($_.StartTime -gt (Get-Date).AddDays(-3)) -and 
    ($_.StartName -eq 'LocalSystem') -and 
    ($_.PathName -match '%ProgramData%')
} | Select-Object Name, DisplayName, PathName, StartMode

---

Frequently Asked Questions (FAQ)

Q1: Is there any chance a decryptor for Rex will ever be released?
A: The only realistic scenario is a future leak of the attackers’ master RSA private key, perhaps from a law enforcement takedown. This is a low-probability event. It is wise to preserve your encrypted data as a long-term hedge, but you cannot plan your recovery around it.

Q2: The note says they stole my data. Is this true?
A: It is highly likely true, as double extortion is the standard operating procedure for MedusaLocker derivatives. A forensic investigation is required to determine the scope of the data breach. This information is crucial for compliance with data protection regulations like GDPR.

Q3: Why is this so hard to decrypt?
A: The MedusaLocker source code is well-written from a cryptographic perspective. The Rex actors have used it correctly, without introducing the flaws that plague lesser ransomware families. There is no known “backdoor” or weakness to exploit.

Q4: Can I at least recover my SQL databases and Virtual Machines from the encrypted disks?
A: No. The encrypted .mdf, .ldf, .vmdk, and .vhdx files are just as permanently locked as any other file. They cannot be mounted or recovered without the private key. Your only path to recovery for these assets is from backups.

Q5: What is the point of keeping the encrypted files if they are useless?
A: It is a low-cost, high-reward insurance policy. Should a future breakthrough occur, you would be able to recover your data. The cost of storing a few terabytes of encrypted files on an offline drive is minimal compared to the potential value of the data if a key ever surfaces.

Q6: Should I report this to law enforcement?
A: Yes. Report the incident to the FBI via IC3.gov. While they cannot provide a decryption key, your report contributes to a larger body of intelligence that can be used to track, disrupt, and prosecute these criminal syndicates.

This sober assessment and strategic guidance is provided by the incident response team at StopDjvuDecryptor.org, a technical division of Cloud Cover LLC, dedicated to providing clear, actionable intelligence during the most severe cyber crises.

---

About the Author:

This guide was produced by the security team at StopDjvuDecryptor.org. We are a specialized ransomware recovery division of Cloud Cover LLC, an Ohio-based Managed Service Provider led by Brent Kenreich (Microsoft-certified author with 25+ years of IT experience). Our mission is to provide safe, verified alternatives to paying hackers.
Copyright © 2023-2026 Cloud Cover LLC.