Dissecting and Detecting Babuk ransomware Cryptography

This report analyzes the Babuk ransomware family, detailing three platform-specific variants (Windows, ESXi, NAS), the use of Curve25519 ECDH to generate per-file shared secrets and fast stream ciphers (Sosemanuk, HC-128, ChaCha variants) for encryption, noted exploitation vectors including OpenSLP and several Microsoft Exchange CVEs plus phishing and RDP, the impact of the public source-code leak enabling clones, and released Yara rules to detect the cryptographic implementations.