Nibiru ransomware variant decryptor

Summary: Nikhil Hegde developed a decryptor for the Nibiru ransomware variant, which targets a long list of file extensions including .doc, .docx, .xls, .xlsx, .jpg, .zip, .mp4, .apk and .encrypt. The tool is available for download on the Talos GitHub, and the source lists an example hash of e0a681902f4f331582670e535a7d1eb3d6eff18d3fbed3ffd2433f898219576f.
Bottom line: A working decryptor for one ransomware variant is useful only to organizations that kept the encrypted files and the matching sample; for everyone else, the list of targeted extensions shows how much of a typical file share Nibiru reaches.

Read the original at Cisco Talos ↗

Topics: Malware
Related: ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026
Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026
Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026