How do blue teams find ransomware encryption problems and write decryptors for them?

[ccsoup]

How do blue teams find ransomware encryption problems and write decryptors for them?

 

[MalwareTech]

Usually by looking for flaws in the cryptography that allow decryption without the key, or by recovering re-used or insecurely stored keys. 

[Florian]

Bad implementation. The libabries are often solid and strong. Attacking the Crypto is dumb.

[Florian]

Sometimes it is stuff like Key in Memory or so which let you decrypt it