Decryptor for Babuk ransomware variant released after hacker arrested

Cisco Talos, in cooperation with Dutch police, obtained the private decryption key used by the Tortilla variant of Babuk ransomware (which leveraged ProxyShell exploits against Microsoft Exchange), enabling Avast to update its Babuk decryptor and leading to the operator's arrest; the report also notes multiple other operations have reused Babuk code.