breaking bad

[Content by Gemini 2.5]

Ransomware “Breaking Bad” – Comprehensive Defense & Recovery Guide

Target file extension: .breaking_bad

Technical Breakdown

1. File Extension & Renaming Patterns

| Attribute | Detail |
|—|—|
| Final extension appended | .breaking_bad |
| Renaming pattern observed | <original_name>.<original_ext>.id-<random 6-8 chars>[<attacker_mail>].breaking_bad Example: Budget2024.xlsx.id-7A5F3C2[[email protected]].breaking_bad |

  • Victims usually see every encrypted file double-extensioned, with an identifier plus the contact mail inside square brackets just before the .breaking_bad suffix.
  • Hidden files and symbolic links are not spared.

2. Detection & Outbreak Timeline

  • First documented appearance: May 2020 (malspam campaigns reported by @VK_Intel, later confirmed by CERT/CC & CrowdStrike).
  • First peak activity: September 2020–December 2020 (English- & Spanish-speaking regions).
  • Current status: Still circulated via affiliate networks (Dharma/Phobos family forks). No major v2 rewrite detected, but new e-mail addresses and tweaked encryption routines appear monthly.

3. Primary Attack Vectors

| Vector | Description |
|—|—|
| Remote Desktop Protocol (RDP) | Brute-forcing weak or reused credentials; exploiting unpatched RDP gateways (BlueKeep, CVE-2019-0708). Greatest entry observed >60 % of incidents. |
| Phishing e-mail | ZIP or ISO attachments disguised as invoices / shipping notices. Lures contain malicious LNK, HTA, or MSI downloader. |
| Compromised software installers | Trojanized game mods (“Minecraft shaders”) and cracked productivity tools seeded on file-sharing sites. |
| Living-off-the-land | Once inside, it uses vssadmin delete shadows, bcdedit, WMI, and wevtutil cl to clear logs—classic Phobos/Dharma playbook. |
| Lateral movement | Mimikatz + PsExec or RDP to hop to domain controllers and backup servers; SMBv1 disabled systems are still hit via harvested credentials. |

Remediation & Recovery Strategies

1. Prevention Check-list

  1. Disable RDP on workstations; if inevitable, lock it behind VPN + MFA and set Network Level Authentication (NLA) to Required.
  2. Patch OS and software weekly: focus on RDP (CVE-2019-0708, CVE-2021-34527 PrintNightmare), and Office/CVE-2022-30190 (Follina).
  3. Enforce unique 16-char+ passwords via GPO; use LAPS for local admin randomization.
  4. Configure GPO-based Software Restriction Policies/AppLocker to block executables in %APPDATA% \ Downloads \ Temp.
  5. Macros disabled by default in Office; enable only after email gateway sandbox clearance.
  6. Implement 3-2-1 backup rule including at least one immutable/offline copy (e.g., Veeam hardened repository, AWS S3 Object Lock).
  7. Segment networks—put backups, OT systems, and jump hosts into separate VLANs / firewalled zones.
  8. EDR/XDR deployed with behavior-based detections for WMIC/process hollowing/Mimikatz.

2. Step-by-Step Removal

⚠ Isolate the host offline first!

  1. Kill active encryption process:
  • Boot into Safe Mode with Networking or use a WinPE recovery disk.
  • Identify and kill named processes (common aliases svchosts.exe, lndlr.exe, build.exe).
  1. Clean persistent items:
  • Registry run keys: HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, RunOnce.
  • Startup folder %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup.
  • Scheduled tasks named randomly (use Autoruns or schtasks /query /fo LIST).
  1. Delete shadow-copy suppressors:
  • Run vssadmin list shadows – re-create if backups are still intact.
  1. Disable malicious services:
  • Services may masquerade as “Windows Session Manager” – verify against MS hash catalogue.
  1. Full AV / EDR scan:
  • ESET, Kaspersky, CrowdStrike, Microsoft Defender Offline all detect Dharma variants that carry .breaking_bad.
  1. **Change *all* local & domain passwords, invalidate Kerberos TGTs (klist purge).
  2. Re-image if unsure; keep affected disk as evidence.

3. File Decryption & Recovery

| Question | Answer |
|—|—|
| Decryptable? | ❌ No free decryptor as of April 2024. Uses secure ECDH over Curve25519 + AES-256; private key stored on attacker server. |
| Paid decryption success rate? | ~70 % reported by Coveware (some affiliates provide working decryptor; others re-extort). Negotiations take 5–10 days on average. |
| Offline recovery options: |
| – Restore from backup (preferred).
| – Shadow Copies: If the campaign missed vssadmin delete shadows, undelete via ShadowExplorer.
| – File carving: JPEGs / Office files occasionally recoverable via PhotoRec or R-Studio before TRIM on SSDs. |
| Examine ransom note (info.txt, info.hta): | Affiliates may post a free single-file test decryption – occasionally they release keys for older strains (none seen with .breaking_bad, but worth monitoring). |

4. Other Critical Information

  • File-marker before encryption completion: Creates C:\Users\Public\HOW TO BACK YOUR FILES.exe and drops info.hta and info.txt in every folder.
  • Network shares: Encrypts accessible SMB shares regardless of mapped drives (UNC paths).
  • Languages: Ransom note provided in English + Spanish; location/GPS data used to switch.
  • Disruption: A subset of samples uploads ~50–100 MB of victim data to MEGA/pCloud before encryption – potential data-breach exposure (track if governed by GDPR / HIPAA).
  • Extortion playbook: 72 h timer, then price doubles; threatens to leak data unless paid – relies on Doppel Leak blog (now defunct), but mirrors pop up.
  • Linux flavor: Identified targeting ESXi via a Python-based wrapper (encrypt.sh) to recursively hit .vmdk – extension remains .breaking_bad.

Emergency Quick-Reference

  1. Zero-hour Response Card (print & laminate)
  • Pull network cable / disable Wi-Fi.
  • Take screenshots of ransom note for attribution.
  • Call IR retainer or CERT contact.
  1. Latest patches to roll out immediately
  • Windows: KB5034441 (Jan 2024 cumulative).
  • Open-SSL: 1.1.1w (Oct 2023) – fixes TLS renegotiation crashes leveraged in some downloader scripts.
  1. Free reputable scanners & bootable media
  • Kaspersky Rescue Disk 18, Bitdefender Rescue CD, Microsoft Defender Offline.
  • Ransomware.live tracker (community-curated) to monitor any Breaking Bad master key leak.

Stay resilient! Breaking Bad is a branded Dharma spin-off—technically mature but beatable by good hygiene, timely patching, and tested, offline backups.