Hacking research collective and consulting think tank SRLabs has released a decryptor to help Black Basta ransomware victims restore their files for free.
Active since at least April 2022, Black Basta has become one of the most prolific ransomware families, being responsible for more than 300 successful attacks to date and estimated to have received over $100 million in ransom payments.
Believed to be linked to the infamous Conti group, Black Basta has claimed responsibility for multiple high-profile intrusions, such as ABB, Capita, Maple Leaf Foods, Rheinmetall, and Thales, stealing victims' data and threatening to release it publicly unless a ransom was paid.
Last week, SRLabs announced that they found a weakness in the encryption algorithm used by the Black Basta ransomware, where the ChaCha keystream used to XOR 64-byte chunks of the target file was not advanced properly, resulting in the same 64 bytes being used to XOR all blocks to be encrypted.
By analyzing this pattern, the company was able to recover the 64-byte key required for decryption and to create a free decrypting tool that can help victims recover at least some of their files.
Because the encryption process is performed properly for the first 5,000 bytes of a file, those bytes cannot be recovered.
For files that were encrypted multiple times, a manual review may be required for restoration.
The free decryptor can reportedly be used only for files encrypted before Christmas 2023, as the Black Basta developers appear to have fixed the vulnerability in their algorithm.
This Cyber News was published on www.securityweek.com. Publication date: Tue, 02 Jan 2024 17:58:05 +0000