Tortilla

Tortilla is a variant of the Babuk ransomware, a malicious software that encrypts victims' files and demands a ransom for their release. This malware, like others of its kind, can infiltrate systems through dubious downloads, emails, or websites, often unbeknownst to the user. Once inside, it can disrupt operations, steal personal information, or hold data hostage for ransom. The Tortilla group based its crypto-locking malware on the leaked Babuk source code, which led to its widespread use and damage. Fortunately, a breakthrough was achieved with the release of a decryptor for the Tortilla variant of Babuk ransomware. This development greatly simplifies the process of decrypting files locked by Tortilla. Avast updated its free Babuk decryptor, which is also available via the No More Ransom portal, to handle Tortilla-encrypted files. Interestingly, Tortilla used a single public/private key pair to encrypt all its victims' files, unlike other groups that generate new keys for each victim. This did not change the encryption schema, making it easier for victims to decrypt their files. In a significant disruption to the Tortilla group's operations, the leader was arrested by Dutch police in Amsterdam following intelligence provided by Cisco’s Talos threat intelligence group. The arrest was subsequently prosecuted by the Dutch Public Prosecution Office. This event marked a major setback for the ransomware attackers, particularly the Tortilla hackers, who had been wreaking havoc with their Babuk-based variant. The arrest has further enabled security experts to build a free decryptor for Tortilla’s victims, alleviating the impact of this particular strain of ransomware.