Critical Bug in Midnight Ransomware Tool Unlocks File Recovery

First detected by Gen researchers, Midnight ransomware blends familiar mechanics with cryptographic modifications that unintentionally create a window for file recovery, presenting a rare opportunity for victims to reclaim data without paying. The threat appears to take inspiration from Babuk, a ransomware family that first surfaced in early 2021 and drove major attacks before its operators leaked source code.

Midnight uses ChaCha to encrypt file contents and RSA to encrypt the ChaCha20 keys, with the RSA-encrypted key and its SHA256 hash appended to the end of each encrypted file in a uniform format; it also employs intermittent, size-based encryption to speed up processing of large files. It typically appends the .Midnight or .endpoint extension to encrypted files, though some configurations attach the extension string directly to the file content.

Security vendors have released decryptors designed to address Midnight’s cryptographic flaws, guiding users through a wizard-based process to locate encrypted data and restore it without paying a ransom. The article notes that Midnight variants have expanded from targeting high-value files such as databases and backups to encrypting nearly all file types, with some exceptions for certain executables.