After reading some interesting research, the reason why this scenario can be decrypted and restored is because: 1/Just AES encryption 2/Kraken 2.0.7 embeds AES key information into encrypted files, although it is not easy to find Then the decryption and recovery plan was reverse engineered. If GandCrab/LockBit is combined with RSA asymmetric encryption like before, it would be troublesome