What is bDAT Ransomware?

bDAT is a new ransomware strain discovered in early November 2022. The new variant belongs to the Dharma ransomware family.

When it executes on a victim system, bDAT encrypts most files found on it. This will include executables, documents, media files, archives and database file formats.

Once files are encrypted, they receive a new, long extension that consists of the victim's ID, the email used by the ransomware operators and the ".bDAT" string. This will turn a file named "music.mp3" into "music.mp3.id-VICTIM ID.[bkpdata@msgsafe.io].bDAT".

Upon successful encryption of the system, the ransomware generates a plain text ransom note called "info.txt" and displays the same text in a pop-up window. The ransom note in full goes as follows:

YOUR FILES ARE ENCRYPTED

1024

Don't worry, you can return all your files!

If you want to restore them, write to the mail: bkpdata at msgsafe dit io YOUR ID -

If you have not answered by mail within 12 hours, write to us by another mail:bkpdata at onionmail dot org

ATTENTION!

We recommend you contact us directly to avoid overpaying agents

Do not rename encrypted files.

Do not try to decrypt your data using third party software, it may cause permanent data loss.

Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.