'Black Basta Buster' Exploits Ransomware Bug for File Recovery

SRLabs published 'Black Basta Buster,' a decryptor that leverages a flaw in a specific Black Basta ransomware strain's ChaCha-based XOR encryption to allow partial recovery of encrypted files. Recovery requires knowing 64 plaintext bytes in the encrypted portions and works best for files 5,000 bytes–1GB (files >1GB will lose the first 5,000 bytes); the group patched the flaw in mid-December, so only victims infected before the fix (about 153 leaked victims in the affected window) may benefit. The report also reiterates standard defenses such as patching, hardening remote access, EDR/MDR, and offsite backups.