Midnight Ransomware Decryption Flaw: Babuk Successor’s RSA Implementation Mistake Allows Free File Recovery

A new ransomware family called Midnight has emerged, borrowing heavily from the Babuk ransomware framework but with a critical mistake that allows victims to recover encrypted data without paying the ransom. According to Gen researchers, Midnight blends familiar ransomware mechanics with novel cryptographic modifications, some of which unintentionally open the door to file recovery.

Midnight is a direct descendant of Babuk, the RaaS operation that first appeared in 2021 before its source code was leaked, which led to several derivative strains including ESXiArgs and Rorschach. The decryptor workarounds rely on a flaw in the RSA-based key-wrapping used by Midnight, allowing the publicly available Norton Midnight Decryptor to reconstruct the ChaCha20 keys and restore files for free.

The researchers note that a remediation team at Avast and Norton released the decryptor, and step-by-step instructions and official decryptor links are available for both 64-bit and 32-bit Windows systems.