{"id":3558,"date":"2021-10-28T17:11:11","date_gmt":"2021-10-28T11:41:11","guid":{"rendered":"https:\/\/xiarch.com\/blog\/?p=3558"},"modified":"2021-10-28T17:11:14","modified_gmt":"2021-10-28T11:41:14","slug":"babuk-ransomware-decryptor-released-to-recover-files-for-free","status":"publish","type":"post","link":"https:\/\/xiarch.com\/blog\/babuk-ransomware-decryptor-released-to-recover-files-for-free\/","title":{"rendered":"Babuk Ransomware Decryptor released to recover Files for Free"},"content":{"rendered":"\n<p><p style=\"text-align: justify;\">A cybersecurity organization has created and released a decryption tool to help Babuk ransomware victims to recover their files for free. As per our security researchers, the Babuk decryptor was created using exposed source code and decrypt keys.<\/p><\/p>\n\n\n\n<p><p style=\"text-align: justify;\">The victims of Babuk ransomware can download the decryption tool from the servers and decrypt the entire partitions at once by utilizing instructions displayed within the decryptor\u2019s user interface. From our expert\u2019s test, this decryptor will likely work only for the victims whose keys were exposed as part of the Babuk source code dump.<\/p><\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-full\"><img decoding=\"async\" loading=\"lazy\" width=\"608\" height=\"432\" src=\"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/10\/Babuk-Ransomware-Decryptor-released-to-recover-Files-for-free-image1.png\" alt=\"Babuk-Ransomware-Decryptor-released-to-recover-Files-for-free-image1\" class=\"wp-image-3561\" srcset=\"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/10\/Babuk-Ransomware-Decryptor-released-to-recover-Files-for-free-image1.png 608w, https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/10\/Babuk-Ransomware-Decryptor-released-to-recover-Files-for-free-image1-300x213.png 300w\" sizes=\"(max-width: 608px) 100vw, 608px\" \/><\/figure><\/div>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>How are Ransomware and decryption Keys Exposed?<\/strong><\/h2>\n\n\n\n<p><p style=\"text-align: justify;\">Babuk gang&#8217;s full ransomware source code was leaked on a Russian-speaking hacking forum last month by a threat actor claiming to be a member of the ransomware group. The decision to leak the code was motivated by the alleged Babuk member by his terminal cancer condition. He said in his leak post that he decided to release the source code while they have to &#8220;live like a human.&#8221;<\/p><\/p>\n\n\n\n<p><p style=\"text-align: justify;\">The shared archive contained different Visual Studio Babuk ransomware projects for VMware ESXi, NAS, and Windows encryptors, with the Windows folder, contains the complete source code for the Windows encryptor, decryptor, and what looked like private and public key generators.<\/p><\/p>\n\n\n\n<p><p style=\"text-align: justify;\">Included in the leak were also encryptors and decryptors compiled for specific victims of the ransomware gang. After the leak, Emsisoft CTO and ransomware expert Fabian Wosar told our experts that the source code is legitimate and that the archive may also contain decryption keys for past victims.<\/p><\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-full\"><img decoding=\"async\" loading=\"lazy\" width=\"1014\" height=\"538\" src=\"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/10\/Babuk-Ransomware-Decryptor-released-to-recover-Files-for-free-image2.jpg\" alt=\"Babuk-Ransomware-Decryptor-released-to-recover-Files-for-free-image2\" class=\"wp-image-3562\" srcset=\"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/10\/Babuk-Ransomware-Decryptor-released-to-recover-Files-for-free-image2.jpg 1014w, https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/10\/Babuk-Ransomware-Decryptor-released-to-recover-Files-for-free-image2-300x159.jpg 300w, https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/10\/Babuk-Ransomware-Decryptor-released-to-recover-Files-for-free-image2-768x407.jpg 768w\" sizes=\"(max-width: 1014px) 100vw, 1014px\" \/><\/figure><\/div>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>What is the Babuk\u2019s Troubled History?<\/strong><\/h2>\n\n\n\n<p><p style=\"text-align: justify;\">Babuk Locker, also known as Babyk and Babuk, is a ransomware operation that started at the beginning of 2021 when it begins targeting businesses to hijack and encrypt their data as part of double-extortion attacks.<\/p><\/p>\n\n\n\n<p><p style=\"text-align: justify;\">Right after the attack on the Washington DC\u2019s Metropolitan Police Department (MPD) they landed in U.S. law enforcement\u2019s crosshairs and claimed to have shut down their operation after they started to feel the heat.<\/p><\/p>\n\n\n\n<p><p style=\"text-align: justify;\">After this attack, the gang&#8217;s &#8216;Admin&#8217; allegedly wanted to leak the stolen MPD data online for publicity, while the other members were against it.<\/p><\/p>\n\n\n\n<p><p style=\"text-align: justify;\">Following this, Babuk members splintered off, with the original admin launching the Ramp cybercrime forum and the others relaunching the ransomware under the Babuk V2 name, continuing to target and encrypt victims ever since.<\/p><\/p>\n\n\n\n<p><p style=\"text-align: justify;\">Right after the Ramp cybercrime forum&#8217;s launch, it was targeted by a series of DDoS attacks that eventually led to the site becoming unusable. While the Babuk Admin blamed his former partners for the third incident, the Babuk V2 team told our security investigators that they were not behind the attacks.<\/p><\/p>\n","protected":false},"excerpt":{"rendered":"<p>A cybersecurity organization has created and released a decryption tool to help Babuk ransomware victims to recover their files for free. As per our security researchers, the Babuk decryptor was created using exposed source code and decrypt keys. The victims of Babuk ransomware can download the decryption tool from the servers and decrypt the entire [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":3560,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[6],"tags":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v20.11 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Babuk Ransomware Decryptor released to recover Files for Free - Xiarch Solutions Private Limited<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/xiarch.com\/blog\/babuk-ransomware-decryptor-released-to-recover-files-for-free\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Babuk Ransomware Decryptor released to recover Files for Free - Xiarch Solutions Private Limited\" \/>\n<meta property=\"og:description\" content=\"A cybersecurity organization has created and released a decryption tool to help Babuk ransomware victims to recover their files for free. As per our security researchers, the Babuk decryptor was created using exposed source code and decrypt keys. The victims of Babuk ransomware can download the decryption tool from the servers and decrypt the entire [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/xiarch.com\/blog\/babuk-ransomware-decryptor-released-to-recover-files-for-free\/\" \/>\n<meta property=\"og:site_name\" content=\"Xiarch Solutions Private Limited\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/xiarch\/\" \/>\n<meta property=\"article:published_time\" content=\"2021-10-28T11:41:11+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2021-10-28T11:41:14+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/10\/Babuk-Ransomware-Decryptor-released-to-recover-Files-for-free-featured-image.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1000\" \/>\n\t<meta property=\"og:image:height\" content=\"525\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Xiarch Security\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@xiarch\" \/>\n<meta name=\"twitter:site\" content=\"@xiarch\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Xiarch Security\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/xiarch.com\/blog\/babuk-ransomware-decryptor-released-to-recover-files-for-free\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/xiarch.com\/blog\/babuk-ransomware-decryptor-released-to-recover-files-for-free\/\"},\"author\":{\"name\":\"Xiarch Security\",\"@id\":\"https:\/\/xiarch.com\/blog\/#\/schema\/person\/655d814a04eacce56942270cfdc5c59c\"},\"headline\":\"Babuk Ransomware Decryptor released to recover Files for Free\",\"datePublished\":\"2021-10-28T11:41:11+00:00\",\"dateModified\":\"2021-10-28T11:41:14+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/xiarch.com\/blog\/babuk-ransomware-decryptor-released-to-recover-files-for-free\/\"},\"wordCount\":453,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/xiarch.com\/blog\/#organization\"},\"articleSection\":[\"Vulnerabilities\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/xiarch.com\/blog\/babuk-ransomware-decryptor-released-to-recover-files-for-free\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/xiarch.com\/blog\/babuk-ransomware-decryptor-released-to-recover-files-for-free\/\",\"url\":\"https:\/\/xiarch.com\/blog\/babuk-ransomware-decryptor-released-to-recover-files-for-free\/\",\"name\":\"Babuk Ransomware Decryptor released to recover Files for Free - Xiarch Solutions Private Limited\",\"isPartOf\":{\"@id\":\"https:\/\/xiarch.com\/blog\/#website\"},\"datePublished\":\"2021-10-28T11:41:11+00:00\",\"dateModified\":\"2021-10-28T11:41:14+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/xiarch.com\/blog\/babuk-ransomware-decryptor-released-to-recover-files-for-free\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/xiarch.com\/blog\/babuk-ransomware-decryptor-released-to-recover-files-for-free\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/xiarch.com\/blog\/babuk-ransomware-decryptor-released-to-recover-files-for-free\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/xiarch.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Babuk Ransomware Decryptor released to recover Files for Free\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/xiarch.com\/blog\/#website\",\"url\":\"https:\/\/xiarch.com\/blog\/\",\"name\":\"Xiarch Solutions Private Limited\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\/\/xiarch.com\/blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/xiarch.com\/blog\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/xiarch.com\/blog\/#organization\",\"name\":\"Xiarch\",\"url\":\"https:\/\/xiarch.com\/blog\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/xiarch.com\/blog\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/06\/xi-logo-002.png\",\"contentUrl\":\"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/06\/xi-logo-002.png\",\"width\":300,\"height\":300,\"caption\":\"Xiarch\"},\"image\":{\"@id\":\"https:\/\/xiarch.com\/blog\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/xiarch\/\",\"https:\/\/twitter.com\/xiarch\",\"https:\/\/www.linkedin.com\/company\/xiarch\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/xiarch.com\/blog\/#\/schema\/person\/655d814a04eacce56942270cfdc5c59c\",\"name\":\"Xiarch Security\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/xiarch.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/d33699ed91b76568586dc1ae278ea568?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/d33699ed91b76568586dc1ae278ea568?s=96&d=mm&r=g\",\"caption\":\"Xiarch Security\"},\"sameAs\":[\"https:\/\/xiarch.com\/blog\/\"],\"url\":\"https:\/\/xiarch.com\/blog\/author\/vector\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Babuk Ransomware Decryptor released to recover Files for Free - Xiarch Solutions Private Limited","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/xiarch.com\/blog\/babuk-ransomware-decryptor-released-to-recover-files-for-free\/","og_locale":"en_US","og_type":"article","og_title":"Babuk Ransomware Decryptor released to recover Files for Free - Xiarch Solutions Private Limited","og_description":"A cybersecurity organization has created and released a decryption tool to help Babuk ransomware victims to recover their files for free. As per our security researchers, the Babuk decryptor was created using exposed source code and decrypt keys. The victims of Babuk ransomware can download the decryption tool from the servers and decrypt the entire [&hellip;]","og_url":"https:\/\/xiarch.com\/blog\/babuk-ransomware-decryptor-released-to-recover-files-for-free\/","og_site_name":"Xiarch Solutions Private Limited","article_publisher":"https:\/\/www.facebook.com\/xiarch\/","article_published_time":"2021-10-28T11:41:11+00:00","article_modified_time":"2021-10-28T11:41:14+00:00","og_image":[{"width":1000,"height":525,"url":"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/10\/Babuk-Ransomware-Decryptor-released-to-recover-Files-for-free-featured-image.jpg","type":"image\/jpeg"}],"author":"Xiarch Security","twitter_card":"summary_large_image","twitter_creator":"@xiarch","twitter_site":"@xiarch","twitter_misc":{"Written by":"Xiarch Security","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/xiarch.com\/blog\/babuk-ransomware-decryptor-released-to-recover-files-for-free\/#article","isPartOf":{"@id":"https:\/\/xiarch.com\/blog\/babuk-ransomware-decryptor-released-to-recover-files-for-free\/"},"author":{"name":"Xiarch Security","@id":"https:\/\/xiarch.com\/blog\/#\/schema\/person\/655d814a04eacce56942270cfdc5c59c"},"headline":"Babuk Ransomware Decryptor released to recover Files for Free","datePublished":"2021-10-28T11:41:11+00:00","dateModified":"2021-10-28T11:41:14+00:00","mainEntityOfPage":{"@id":"https:\/\/xiarch.com\/blog\/babuk-ransomware-decryptor-released-to-recover-files-for-free\/"},"wordCount":453,"commentCount":0,"publisher":{"@id":"https:\/\/xiarch.com\/blog\/#organization"},"articleSection":["Vulnerabilities"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/xiarch.com\/blog\/babuk-ransomware-decryptor-released-to-recover-files-for-free\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/xiarch.com\/blog\/babuk-ransomware-decryptor-released-to-recover-files-for-free\/","url":"https:\/\/xiarch.com\/blog\/babuk-ransomware-decryptor-released-to-recover-files-for-free\/","name":"Babuk Ransomware Decryptor released to recover Files for Free - Xiarch Solutions Private Limited","isPartOf":{"@id":"https:\/\/xiarch.com\/blog\/#website"},"datePublished":"2021-10-28T11:41:11+00:00","dateModified":"2021-10-28T11:41:14+00:00","breadcrumb":{"@id":"https:\/\/xiarch.com\/blog\/babuk-ransomware-decryptor-released-to-recover-files-for-free\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/xiarch.com\/blog\/babuk-ransomware-decryptor-released-to-recover-files-for-free\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/xiarch.com\/blog\/babuk-ransomware-decryptor-released-to-recover-files-for-free\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/xiarch.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Babuk Ransomware Decryptor released to recover Files for Free"}]},{"@type":"WebSite","@id":"https:\/\/xiarch.com\/blog\/#website","url":"https:\/\/xiarch.com\/blog\/","name":"Xiarch Solutions Private Limited","description":"","publisher":{"@id":"https:\/\/xiarch.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/xiarch.com\/blog\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/xiarch.com\/blog\/#organization","name":"Xiarch","url":"https:\/\/xiarch.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/xiarch.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/06\/xi-logo-002.png","contentUrl":"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/06\/xi-logo-002.png","width":300,"height":300,"caption":"Xiarch"},"image":{"@id":"https:\/\/xiarch.com\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/xiarch\/","https:\/\/twitter.com\/xiarch","https:\/\/www.linkedin.com\/company\/xiarch"]},{"@type":"Person","@id":"https:\/\/xiarch.com\/blog\/#\/schema\/person\/655d814a04eacce56942270cfdc5c59c","name":"Xiarch Security","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/xiarch.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/d33699ed91b76568586dc1ae278ea568?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/d33699ed91b76568586dc1ae278ea568?s=96&d=mm&r=g","caption":"Xiarch Security"},"sameAs":["https:\/\/xiarch.com\/blog\/"],"url":"https:\/\/xiarch.com\/blog\/author\/vector\/"}]}},"_links":{"self":[{"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/posts\/3558"}],"collection":[{"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/comments?post=3558"}],"version-history":[{"count":1,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/posts\/3558\/revisions"}],"predecessor-version":[{"id":3563,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/posts\/3558\/revisions\/3563"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/media\/3560"}],"wp:attachment":[{"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/media?parent=3558"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/categories?post=3558"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/tags?post=3558"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}