Babuk Tortilla ransomware decryptor made available

Cyber security experts at Cisco Talos and Avast, working alongside law enforcement in the Netherlands, have collaborated to make available a decryptor for the Tortilla variant of the infamous Babuk ransomware, allowing victims compromised by the gang dating back to 2021 to recover their files.

In a joint operation, intelligence supplied to the Dutch police by Talos enabled the force to identify and take into custody the threat actor behind Babuk Tortilla and prosecute them.

Meanwhile, as a result of the sting, Talos researchers were able to get their hands on the private decryption key for Tortilla, which was subsequently shard with Avast Threat Labs, given the Czechia-based supplier had previously released a de facto industry standard decryptor for Babuk.

This was done by extracting the private key from the decryptor and passing that to Avast, so as to avoid exposing any users to executable code created by the ransomware’s authors.

“The Avast Babuk decryptor is optimised for performance and allows users to recover their files very quickly if the Babuk variant uses one of the known private decryption keys,” wrote Cisco Talos researcher Vanja Svajcer. “The initial decryptor was released in October 2021, and it has been actively supported by Avast Threat Labs’ engineers.

“Its simple user interface allows even users with minimal experience in ransomware recovery to easily understand its usage and purpose,” he said.

The updated decryptor now includes all known private keys, which it is hoped will enable many users to retrieve their data, said Cisco Talos. It’s now available through NoMoreRansom, a joint project between industry, the Dutch National High Tech Crime Unit, and Europol’s European Cybercrime Centre, as well as from Avast itself.