Free Decryptor Released for Black Basta and Babuk's Tortilla Ransomware Victims

Cisco Talos and Avast released an updated decryptor enabling victims of the Tortilla (Babuk-derived) ransomware campaign to recover files; Talos' intelligence sharing aided a law enforcement arrest. The report notes Tortilla’s use of ProxyShell Exchange exploits, lists other Babuk-derived ransomware families, and references SRLabs' Black Basta decryptor research which exploited a cryptographic weakness but was later mitigated by the ransomware authors.