BabyDuck Ransomware Threatens to Leak Stolen Files

During our analysis of newly discovered file samples, we came across a ransomware program known as BabyDuck. This particular malware is based on the Babuk ransomware.

When we tested the BabyDuck sample on our system, it encrypted files and appended the ".babyduck" extension to their filenames. For instance, a file named "1.jpg" would be transformed into "1.jpg.babyduck", and "2.png" would become "2.png.babyduck", and so on. Additionally, BabyDuck dropped a ransom note named "ATTENTION!!!.txt" onto the desktop.

The ransom note delivered by BabyDuck informs the victim that their files have been encrypted and can only be decrypted by paying a ransom of 1000 XMR, which is the Monero cryptocurrency. At the time of writing, this amount is equivalent to over 140 thousand USD. However, the note suggests that negotiation regarding the ransom may be possible.

Furthermore, the message serves as a warning that if the victim fails to contact or pay the cybercriminals within 72 hours or goes against their demands, the encrypted data will be leaked to the public.

BabyDuck Ransom Note Threatens Data Leaks

The full text of the BabyDuck ransom note goes as follows:

Ducky has got your files encrypted!

This happened because you were not paying attention to your security.

Ducky will give you your files back if you pay him a bit of crypto.

1000 XMR to address

(two alphanumeric strings)

DUCKY WILL MAKE YOUR DATA PUBLIC IF U DON'T BEHAVE!!!

Use TOR browser (hxxps://www.torproject.org/download/) and follow this link, to get the proof of your data is really f*cked up

(onion address)

If you want beg for mercy or negotiate the price, download TOX chat client, and find Ducky there

(alphanumeric string)

AGAIN, READ UP HERE!!! YOU’VE GOT 72 HOURS

1000 XMR to address

(alphanumeric string)

Don't worry, if you behave and pay - you'll get your files back;)

Or you’re gonna be f*cked up. Quack-quack…

YOUR KEY IS
(alphanumeric string)

How Can You Protect Your Data from Ransomware Like BabyDuck?

Protecting your data from ransomware like BabyDuck requires a proactive approach and implementing several preventive measures. Here are some important steps you can take to safeguard your data:

• Backup your data: Regularly back up your important files to an offline or cloud storage solution. Ensure that your backups are not directly accessible from your computer or network to prevent them from being affected by ransomware. Test your backups periodically to ensure their integrity and ability to restore data.
• Keep your software up to date: Install security updates, patches, and bug fixes for your operating system, software applications, and plugins. Regularly check for updates and enable automatic updates whenever possible. Outdated software can have vulnerabilities that ransomware can exploit.
• Use robust security software: Install and maintain reliable antivirus and anti-malware software on all your devices. Keep the software updated and perform regular system scans to detect and remove any malicious programs, including ransomware.
• Exercise caution with email attachments and links: Be vigilant when opening email attachments or clicking on links, especially if they come from unknown or suspicious sources. Verify the sender's identity and scan attachments with security software before opening them. Avoid visiting untrusted websites or clicking on suspicious ads.
• Enable firewall protection: Activate and configure a firewall on your devices and network to monitor incoming and outgoing network traffic. A firewall can help block unauthorized access and potentially malicious connections.
• Practice safe browsing habits: Be cautious when visiting websites, especially those of questionable reputation or that offer pirated content. Stick to reputable sources for software downloads and updates. Avoid clicking on pop-ups or downloading files from unverified sources.

Remember, prevention is key, but in case of a ransomware incident, it's important to avoid paying the ransom. Report the incident to law enforcement and consult with a cybersecurity professional to explore possible options for data recovery.