Babuk Locker’s Code Leak - More Trouble for Security Agencies

What happened?

• Moreover, every custom version of Babuk encryptor created using the builder app can generate decrypters. They can also be used to restore the encrypted files from each victim.
• The leak happened two months after the ransomware gang announced about retiring from ransomware operations, which was soon after the attack on the Washington, DC police department in April.
• In May, the gang rebranded its ransomware leak site as Payload[.]bin. Further, it started working as a third-party host for other ransomware gangs who wanted to leak files from victims, however, did not want to operate their own leak site.
• It is not known if the gang attempted to sell its ransomware builder to a third party in a transaction that went south, or if the builder was leaked by a rival gang or a security researcher.

Other leaked ransomware code

• Two weeks ago, the source code of Paradise ransomware was shared on a public hacking forum. The ransomware code was shared on a Russian-speaking forum known as the XSS.
• Last year, ArisLocker ransomware’s source code was found to be spreading on the dark web. The strain had a weakness in its encryption system, enabling security researchers to exploit it.

Conclusion