On: Linux ransomware in the wild

[zython]

well, when wannacry was around, you could "salvage" the decryption key from an infected machine before it was rebooted.

not saying your idea is bad advice but you need the full picture to counter ransomware attacks

[runeks → zython]

Ironically, /dev/mem has been disabled to counter malware, otherwise you could do

    dd if=/dev/mem of=~/mem.img 

to obtain an image dump which may contain the decryption key.

[dTal → runeks]

You could kexec a new kernel that didn't have that restriction.