The BARADAI MedusaLocker Ransomware : A Definitive Forensic Recovery Guide

In our recovery lab today at Lockbit Decryptor, we isolated the BARADAI ransomware strain, identified by the .BARADAI extension and the read_to_decrypt_files.html note. Our forensic analysis definitively identifies this as a variant of the MedusaLocker ransomware family. This strain employs a robust hybrid cryptosystem. Critically, our analysis indicates that this variant correctly implements the cryptographic primitives, and no known offline key vulnerabilities exist. Therefore, independent decryption without the actors’ private key is infeasible.

Latest: The Aur0ra Ransomware Variant: A Definitive Forensic Recovery Guide

EMERGENCY TRIAGE (THE GOLDEN HOUR)

If you encounter the .BARADAI extension, execute these four protocols immediately to limit the blast radius:

1. Full Network Segmentation: Immediately isolate all affected subnets. MedusaLocker variants are known for aggressive lateral movement; sever all connections, including RDP, SMB, and administrative shares, to prevent further encryption and data exfiltration.
2. Preserve Disk Images: Before any forensic analysis, create a complete, bit-for-bit forensic image of the system disks from all critical servers using a hardware write-blocker. This is your only evidence and may be crucial for validating the scope of the data breach.
3. Secure Backup Isolation: Physically disconnect all backup appliances (tape, NAS, SAN) from the network. Verify the integrity of your offline backups from a sterile environment; assume any network-connected backups have been targeted and wiped.
4. Password Vault Lockdown: Assume all Active Directory credentials have been compromised. Immediately place all service and administrator accounts in a suspended state and change passwords from a trusted, offline machine.

Also read: The Rex ‘.rex’ MedusaLocker Variant: A Definitive Forensic Recovery Guide

THREAT PROFILE & FORENSICS

Technical Specifications:

File Extension Example: 1.jpg.BARADAI

Persistence Markers:

• Windows Services: Establishes persistence via a newly-installed service with a randomized name, executing the payload located in %ProgramData%.
• Scheduled Tasks: Utilizes schtasks.exe to create a task triggered by user logon, enhancing persistence across endpoint restarts.
• Virtualization Artifacts: The MedusaLocker source code includes modules for targeting ESXi, encrypting VMs stored on attached datastores.

Ransom Note Text:

NETWORK SECURITY NOTIFICATION
YOUR PERSONAL ID: -
YOUR CORPORATE NETWORK HAS BEEN COMPROMISED & ENCRYPTED
Your files are secured with military-grade encryption (RSA-4096 + AES-256)
...
We have successfully infiltrated your network and encrypted critical data.
...
Contact us immediately for pricing and decryption software
EMAIL: recovery1@salamati.vip, recovery1@amniyat.xyz
...
CONTACT US WITHIN 72 HOURS TO PREVENT PRICE INCREASE
TOR CHAT (24/7 SUPPORT):
hxxp://qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd[.]onion
qTox ID: -

MATHEMATICAL VULNERABILITY ANALYSIS

BARADAI, as a MedusaLocker derivative, employs a cryptographically sound hybrid system. Per-file data is encrypted using AES-256 in CBC mode. The symmetric key $K_s$ is then wrapped using the actors’ RSA-4096 public key.

$$Ciphertext, IV = Enc_{AES-256-CBC}(K_s, P)$$
$$Wrapped_Key = Enc_{RSA-PKCS#1v1.5}(PK_{attacker}, K_s)$$

Cryptographic Implementation Assessment:
Our laboratory’s analysis concludes that no known implementation flaw exists in this BARADAI variant’s cryptographic construction. The use of a unique, random IV for each file and the robust AES-CBC mode eliminate common attack vectors. The RSA padding scheme, while older, is implemented correctly. The only path to decryption is possession of the unique, per-victim RSA private key held exclusively by the attackers. Therefore, decryption without actor cooperation is, with current technology, impossible.

IT ADMIN TOOLKIT (POWERSHELL AUDIT)

Deploy this script to conduct a thorough sweep for BARADAI-related IOCs across your fleet.

# Lockbit Decryptor Audit Script for BARADAI (MedusaLocker) Variant
Write-Host "Initiating forensic sweep for BARADAI (MedusaLocker) IOCs..." -ForegroundColor DarkOrange

# 1. Detect Files with the .BARADAI Extension
Get-ChildItem -Path C:\ -Recurse -Include "*.BARADAI" -ErrorAction SilentlyContinue -Depth 3 | 
    Group-Object { $_.Extension } | 
    Where-Object { $_.Count -gt 5 } | 
    ForEach-Object { Write-Host "Potential BARADAI Cluster Detected: '$($_.Name)' affecting $($_.Count) files." }

# 2. Locate Ransom Notes
Get-ChildItem -Path C:\ -Filter 'read_to_decrypt_files.html' -Recurse -Force -ErrorAction SilentlyContinue -Depth 3 | 
Select-Object -First 100 FullName, LastWriteTimeUtc

# 3. Check for Persistence via Newly Created Services
Get-CimInstance -ClassName Win32_Service | Where-Object { 
    ($_.StartTime -gt (Get-Date).AddDays(-3)) -and 
    ($_.StartName -eq 'LocalSystem') -and 
    ($_.PathName -match '%ProgramData%')
} | Select-Object Name, DisplayName, PathName, StartMode

RECOVERY PATHWAYS & CTA

Strategic Recovery Roadmap:

• Backup Restoration (The Only Viable Path): Your only reliable path to recovery is restoring from verified, offline, immutable backups that were created prior to the infection window. All other options are non-viable.
• Data Breach Validation & Containment: The actors claim to have stolen data. Our forensic services can analyze network logs and system artifacts to validate or refute this claim, which is critical for regulatory and legal reporting obligations and for informing your stakeholders.
• Ignore the Actors’ Negotiations: Engaging with recovery1@salamati.vip, recovery1@amniyat.xyz, or their Tor/qTox channels is a high-risk financial transaction with no guarantee of receiving a functional decryptor.
• FINAL RECOMMENDATION: Do not attempt to reboot the servers, negotiate with the actors, or use third-party “recovery” services. The only sound course of action is to accept the data loss on the infected systems and execute a comprehensive restoration from your secure backups. Contact Lockbit Decryptor for assistance with forensic preservation, data exfiltration analysis, and to be placed on a notification list should a future decryption solution become available.

Also read: The ‘.sorry’ Ransomware: A Definitive Forensic Recovery Guide

Frequently Asked Questions (FAQ)

Contact Us To Purchase The BARADAI Decryptor Tool