New Black Basta decryptor exploits ransomware flaw to recover files

SRLabs published a 'Black Basta Buster' decryptor that exploits a flaw in Black Basta's XChaCha20-based encryption, enabling recovery of many files encrypted by versions from November 2022 until the bug was patched a week ago; the report explains recovery limits (file-size dependent), how the keystream can be recovered from zero-byte regions (e.g., virtual disk images), and provides context on Black Basta's criminal activity and notable victims.