Babuk Ransomware Decryption & Data Recovery

Babuk Locker surfaced in January 2021 as one of the first families to systematically combine encryption with data-leak extortion, and among the earliest to ship purpose-built encryptors for VMware ESXi and ARM-based NAS devices. Its best-known incident was the 2021 attack on the Washington DC Metropolitan Police Department and the publication of internal files, after which the crew announced it was leaving the encryption business for a leak-hosting model.

What keeps Babuk relevant is two leaks. In July 2021 the Babuk Locker builder was published, and actors immediately began mass-producing custom payloads with it. In September 2021 a member claiming terminal illness released the full source code - the C++ Windows encryptor, the C++ ELF ESXi encryptor, a Golang NAS encryptor and multiple Visual Studio projects - on a Russian-language forum. Across H2 2022 and H1 2023 SentinelLABS counted at least ten ransomware families whose ESXi lockers were built directly on that code. In practice, many of the "unknown extension" hypervisor ransomware cases seen in Chinese enterprises today inherit their encryption logic from Babuk.

The "Babuk2" or "Babuk-Bjorka" brand that appeared in January 2025 is a different matter. Halcyon, GuidePoint and others found that roughly 90% of its claimed victims had already been posted by RansomHub, FunkSec, LockBit and others, with no evidence of fresh encryption activity - an impersonation operation re-extorting old breach data, disowned even by former Babuk members.

The practical lesson for Chinese organisations: Babuk itself is dormant, but the intrusion path its derivatives keep reusing - an exposed ESXi management interface with weak credentials and no MFA - is still the dominant way virtualisation estates get compromised locally.

Extensions. Original Babuk appends .babuk, .babyk or .babuk2; .doydo and the unusual .NIST_K571 (named after the elliptic curve used) have also been observed. Variants produced from the leaked builder use entirely attacker-chosen extensions, so an unfamiliar extension does not rule out Babuk ancestry.

Ransom note. A text file named How To Restore Your Files.txt (HTML in some builds), in English, stating that files are encrypted and data stolen, and directing the victim to a Tor chat page; early builds also included an email address.

ESXi indicators.

• vmdk, vmx, vmsd and vswp files under /vmfs/volumes encrypted, VMs refusing to power on.
• Unexpected ELF binaries on the host plus traces of bulk shutdowns via esxcli or vim-cmd.
• Notes dropped in the datastore root and /tmp.

NAS indicators. Golang-compiled ARM or x86 binaries walking share directories, with package and snapshot services possibly stopped.

The key question is whether you are facing original Babuk or a builder-derived variant: the former may be decryptable, the latter almost never is. That determination comes from the encrypted-file trailer structure, the embedded public key fingerprint and binary characteristics - not from the extension name.

The access patterns from Babuk's active period, still used by its derivatives today:

• Internet-exposed remote access. Weak RDP credentials and brute forcing were the most common starting point in 2021.
• VPN and edge device vulnerabilities. Unpatched VPN gateways and firewall management interfaces used for an internal foothold.
• Direct hypervisor management access. ESXi and vCenter ports 443, 22 and 902 reachable from the internet or flat office networks, combined with weak credentials or known CVEs, to take the host directly - the signature approach of Babuk-derived ESXi lockers.
• Exposed NAS. Synology, QNAP and similar devices published to the internet on outdated firmware.
• Lateral movement and escalation. Credential dumping, PsExec, scheduled tasks and domain-wide deployment.
• Exfiltration. Archived data shipped out via cloud storage or FTP for leak pressure.

Because the builder is public, the skill level behind Babuk-lineage payloads varies enormously: mature crews running targeted intrusions at one end, opportunists scanning for weak passwords at the other. The latter is what small and mid-size Chinese firms encounter most often.

Algorithms. Original Babuk derives keys with SHA-256, encrypts content with ChaCha8 and performs key agreement via ECDH (Curve25519, or NIST K-571 in some builds), with an independent key per file. By design it is unbreakable without the private key; the 2021 decryptor exists because source code and some private keys leaked, not because the cryptography was flawed.

Intermittent encryption. Large files are encrypted in skipped blocks for speed, with the stride varying by version and builder settings. That leaves untouched regions in database files and virtual disks, which is the main repair entry point in derivative cases - though the achievable extent must be measured.

Virtualisation and NAS. The ESXi build force-stops virtual machines before encrypting datastore files so file locks cannot leave encryption incomplete; the NAS build targets shares and common mount points.

Recovery inhibition. The Windows build deletes volume shadow copies and stops database and backup services; the ESXi build removes VM snapshots.

Double extortion. Babuk was among the first families to run a dedicated leak site, and after retiring its encryptor it pivoted to a pure data-leak platform.