Technical Analysis of BlueSky Ransomware

This report is a technical deep-dive into BlueSky ransomware (first observed June 2022), detailing its initialisation, privilege escalation, mutex and string-decoding mechanisms, targeted file extensions and directories, registry persistence and recovery blob storage, process-killing behavior, IO completion port-based multithreaded encryption (writing ".bluesky" extensions), ransom note generation, and post-encryption cleanup; it also supplies MD5 IoCs and example ransom notes.