New decryptor for Babuk Tortilla ransomware variant released
Summary: Cisco Talos, working with Dutch Police and Avast, recovered a decryptor for the Babuk ransomware variant known as Tortilla, and Dutch Police used Talos intelligence to find and apprehend the actor behind the malware. Talos extracted the private key from the actor's decryptor and added it to Avast's generic Babuk decryptor, available through NoMoreRansom, so users do not have to choose between competing tools for individual variants.
Bottom line: The Tortilla actor used a single key pair against all victims, and the Babuk source code leaked in September 2021 has since been used by 10 different actors Talos documented, so one recovered key does not reduce the exposure created by the leaked builder.
Read the original at Cisco Talos ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026