Babuk Tortilla

Babuk Tortilla is a variant of malware, specifically ransomware, that was first discovered by Cisco Talos researchers in October 2021. This malicious software infiltrates computer systems, often unbeknownst to the user, through suspicious downloads, emails, or websites, and can cause significant harm by stealing personal information, disrupting operations, or holding data for ransom. The Babuk Tortilla decryptor, a tool used to decode files encrypted by this ransomware, is provided by the threat actor behind the attack. It was found that the decryptor used by the threat actors during Babuk Tortilla attacks was inefficient compared to Avast’s recovery key, which allowed affected users a rapid recovery. In January 2024, Cisco Talos obtained executable code capable of decrypting files affected by the Babuk Tortilla ransomware variant. This allowed them to extract and share the private decryption key used by the threat actor. The decryptor was likely created from the leaked Babuk source code and the generator. Cisco Talos collaborated with the Dutch National Police and Avast Threat Labs to assist organizations victimized by the Babuk ransomware variant known as "Tortilla". The Tortilla decryptor is an update to the generic one Avast released in 2021 using leaked source code that included Babuk private keys. The saga of the Babuk Tortilla ransomware came to a close following the arrest of an unnamed threat actor in the Netherlands. Post the arrest, Cisco Talos procured a Babuk Tortilla decryptor to help victims recover from a wider variety of Babuk ransomware strains. This decryptor was shared with Avast, which hosts the industry's go-to generic Babuk decryptor, now updated to support Tortilla victims. Despite the arrest and prosecution of the individual behind Babuk Tortilla by the Amsterdam police force and the Dutch Public Prosecution Office, no further details about the case have been published or provided upon request.