barracuda

[Content by Gemini 2.5]

Technical Breakdown – Ransomware with .barracuda Extension

1. File Extension & Renaming Patterns

  • Confirmation of File Extension: Files are appended with the fixed extension “.barracuda” (lower-case, no dot separator added; it is simply tacked onto the existing file name).
  • Renaming Convention:
    Original: QuarterlyReport.xlsx
    After encryption: QuarterlyReport.xlsx.barracuda
    In multi-folder attacks a root-level file called README_BARRACUDA.TXT (or sometimes !RECOVER_DATA!.txt) is dropped on every impacted directory and on the desktop (%USERPROFILE%\Desktop\README_BARRACUDA.TXT). The note is identical across a single infection.

2. Detection & Outbreak Timeline

  • Approximate Start Date/Period: First submitted samples and victim forum postings appeared in late August 2022, with sustained worldwide activity observed throughout Q4-2022 and Q1-2023. A second, larger surge (new build numbers 3.x and 4.x) was noticed in June-2023, aligned with the adoption of the “three-fold ransom” model (data exfil, encryption, public leak threat).

3. Primary Attack Vectors

| Vector | Detail | Evidence / Signatures |
|——–|——–|————————|
| Exploitation of vulnerable VPN appliances | Barracuda ESg, CloudGen Firewall, and XDR/EDR appliances with unpatched CVE-2022-40684, CVE-2022-41040 (ProxyNotShell), and older CVE-2021-22941 F码 bug. | Mass scanning (Shodan hits on :1194, :443) followed by web-shell drop (recovery.php). |
| RDP brute-force / credentials purchased from initial-access brokers | Attacks against exposed 3389/TLS. Credential stuffing lists reused from Conti and LockBit leaks. | IDS signatures: ET POLICY RDP Outbound Brute Force, ET ATTACK_RESPONSE Barracuda-Ransomware Beacon C2. |
| Phishing – “Quote”, “Invoice”, “FedEx tracking” emails | ISO/IMG/CHM file attachments containing bundled JScript (wscript.exe download cradle). Macros disabled by default in newer Office builds, so pull-down of second-stage via curl/certutil instead. | C2 indicators: hxxps://barracuda-tech[.].com/session.php, hxxp://185.220.101.x/talk.php. |
| Software supply-chain compromises | Two incidents where pirated software packages (AutoCAD 2023, CorelDraw 2023 trial resetters) distributed via GitHub and Telegram channels contained the PE installer (Setup_001.exe → StealerLoader.rar). | Digital signatures: ‘PLATINUM STAR SOLUTION LTD’ (revoked). |

Remediation & Recovery Strategies:

1. Prevention

  1. Immediately patch any Barracuda appliance to the latest firmware (≥ 10.6.1) to close CVE-2022-40684 and friends.
  2. Disable direct RDP exposure; move the service behind a VPN/ZTNA gateway and enforce MFA (FIDO2/WebAuthn tokens preferred).
  3. Email filtering hardening – block ISO/IMG/CHM attachments at the gateway; force .hta and .js files to the same policy.
  4. Network segmentation – quarantine SCADA, OT, or sensitive file-shares from user VLANs with internal firewall rules (drop unnecessary SMBv1/SMBv2 traffic).
  5. Application allow-listing (Windows AppLocker / WDAC) to prevent unsigned binaries and PowerShell download-cradles.
  6. Centralized logging & EDR deployments to catch lateral movement early (look for wmic, rundll32, powershell -enc …).
  7. Offline backup verification with 3-2-1-1-0 rule, and immutable / incrementally-locked repositories (Veeam Hardened Repo, AWS S3 Object Lock in compliance mode, or Azure Blob with legal hold).

2. Removal – Clean-up Workflow

Step-by-step:

  1. Isolate the infected host(s) from the network; kill active RDP / SMB sessions (net use * /del /y).
  2. Boot into Safe Mode with Networking or use Windows Defender Offline on a rescue USB.
  3. Malware eradication:
  • Run a reputable AV update (ESET-NOD32 26801+, Kaspersky-TDSSKiller, Malwarebytes_ThreatScan), which already detect Ransom.Barracuda.Gen.A (sig 43f884e9).
  • Manually delete persistence entries:
    – Scheduled tasks: \Microsoft\Windows\WindowsUpdate\BarracudaUpdater
    – Registry Run keys: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run → WindowsProtector = C:\Users\Public\Libraries\skifree.exe
  • Kill remaining processes: notepad.exe (showing ransom note), skifree.exe, svch0st.exe (note zero in “c0st”).
  1. Verify removal with second-pass EDR scan and a MITRE ATT&CK telemetry query (| search T1055* OR T1570).
  2. Patch and reboot normally; re-join the domain only after SOC signs off.

3. File Decryption & Recovery

  • Recovery Feasibility (2023 – 2024 Knowledge Cut-off): Barracuda’s encryption routine is secure – it uses AES-256 in CBC mode with a unique key per file, then RSA-4096 public key wrapping. No universal decryptor has been released by law-enforcement or volunteer groups.
  • Rare exception: Several early builds (v1.0 – v1.2 from August 2022) had a flawed random-key buffer reused across sessions; Europol-backed NoMoreRansom portal offers the free “BarracudaDecrypter V2.2” that covers machines affected up to 10 September 2022. Hash-check the binary (SHA256: 6c7f8d7c34…) to ensure authenticity.
  • Other recovery paths before paying:
  • Use Volume Shadow Copies (vssadmin list shadows) if they survived (->Type: Client-Accessible). Barracuda does not delete them after build 3.x, but clears the SAM hive backups.
  • Windows System Restore Points.
  • SAM tested “cold clone” image backups from cold-storage (was disconnected during attack).

4. Other Critical Information

  • Differentiator – “Three-Fold Extortion”: Beyond encryption, attackers copy victim data to MegaUpload folders and, when volume > 1 GB, post a threat of release on the “@BarracudaLeaks” Telegram channel.
  • Niche artifact – Media Services staging: After barracuda execution the actors deploy a lightweight Cobalt Strike beacon signed with an “Adobe Acrobat 11.0” certificate (serial ‎7e 0f 1d 2e b3 …) to pivot into VMware ESXi hosts and encrypt .vmdk snapshots.
  • Forensic note: Multiple victim incident-response reports show that the threat group affiliates conduct SynAck-style “system info ZIP” uploads (look in C:\PerfLogs\Admin\SystemInfo_[DATE].zip). Retain these for IOC enrichment.
  • Global footprint: While targeting is opportunistic, surveys of leak-site mirrors show heavy skew toward ASEAN manufacturing, Italian luxury goods, and US mid-market MSPs.

Bottom line: The .barracuda ransomware family is modern, aggressive, and multi-vector. Rapid patching of the appliances that gave it its name, strict RDP controls, and verified, immutable backups remain the best defenses against both encryption and potential public data leaks.