Comprehensive Threat Intelligence Report: Forensic Dissection of PicMo Ransomware and the Babuk (Babyk) Architectural Lineage

When an enterprise network goes dark, and administrators discover that their critical database arrays, SQL backups, and virtual machine containers have been entirely renamed to chaotic, 16-character hexadecimal strings ending in randomized extensions like .jHznjwAp, standard incident response playbooks often fail. This severe obfuscation tactic is the primary calling card of the PicMo ransomware cartel.

Identified through a surge of sophisticated intrusions across mid-market enterprise sectors, PicMo represents a highly evolved permutation of targeted network extortion. Unlike Ransomware-as-a-Service (RaaS) operations that utilize predictable, static file extensions across all their victims to build brand recognition, the PicMo operators prioritize maximum chaos and structural disruption. By generating a completely unique extension string per infection and erasing the original file names, they effectively blind automated system restoration tools, file recovery carvers, and standard Antivirus endpoint detection systems.

Coupled with an aggressive, psychologically manipulative extortion strategy that mocks corporate security postures while instructing victims on advanced cryptocurrency laundering techniques, PicMo poses an existential threat to infected organizations. This comprehensive 2,000+ word forensic analysis details the threat’s architectural roots, its execution methodology, its cryptographic matrix, and the exact procedures required to contain and reverse the damage in a laboratory environment.

1. Threat Lineage: The Babuk (Babyk) Codebase Connection

To defeat a ransomware variant, forensic engineers must first understand its genetic makeup. While the threat actors refer to themselves as “PicMo,” heuristic analysis and reverse-engineering of the payload binary reveal deep, incontrovertible ties to one of the most infamous ransomware families in recent history: Babuk (also detected as Babyk or Babuk Locker).

In late 2021, a disgruntled developer associated with the original Babuk ransomware cartel leaked the entire C++ source code for the malware’s builder, ESXi encryptor, and Windows payload generators onto a Russian-speaking hacker forum. This leak drastically altered the global threat landscape. It allowed independent, highly skilled cybercriminal cells—like the group behind PicMo—to take an enterprise-grade cryptographic engine, modify it, remove its original branding, and deploy it for their own bespoke extortion campaigns.

The forensic overlap is confirmed by major endpoint detection and response (EDR) telemetry engines. When analyzing the core execution behavior of the PicMo payload, security vendors consistently flag it under Babuk identifiers:

Because PicMo utilizes the Babuk source code as its foundation, our laboratory possesses a deep, pre-existing understanding of its structural vulnerabilities, thread management flaws, and cryptographic handling, which are critical for engineering decryption pathways.

2. Initial Access & Lateral Movement Tactics

PicMo is not distributed via automated, low-level spam campaigns. It is a human-operated ransomware (HumOR) threat. The operators manually breach the network, conduct reconnaissance, and deploy the payload only after securing maximum leverage. The ransom note itself arrogantly confirms this, stating: “it was the misconfiguration of your corporate network that allowed us to attack you.”

This “misconfiguration” typically falls into three specific initial access vectors:

• Exposed Remote Desktop Protocol (RDP): The most common ingress point. Attackers scan the internet for open RDP ports (3389 or non-standard forwarded ports) and utilize brute-force clusters or credential-stuffing tools to log in using administrative accounts lacking Multi-Factor Authentication (MFA).
• Unpatched Edge Devices: Exploitation of known vulnerabilities in enterprise VPN appliances (such as Fortinet, Pulse Secure, or SonicWall) or unpatched Microsoft Exchange servers (ProxyShell/ProxyLogon flaws) allows attackers to bypass perimeter security entirely and drop web shells onto the internal network.
• Initial Access Brokers (IABs): The PicMo group frequently purchases pre-existing network access from dark web brokers who specialize in silently harvesting corporate credentials via InfoStealer malware (like RedLine or Raccoon Stealer) residing on employee home computers.

Once inside, the operators utilize legitimate administrative tools—such as Cobalt Strike, PowerShell Empire, and Advanced IP Scanner—to map the Active Directory environment. They locate the Domain Controller, escalate privileges to NT AUTHORITY\SYSTEM, and use Group Policy Objects (GPOs) or PsExec to simultaneously push the PicMo encryptor to every connected workstation, server, and Network Attached Storage (NAS) array on the domain.

3. The “Double-Randomization” Obfuscation Anomaly

The most visually alarming aspect of a PicMo infection is its approach to file renaming. Most ransomware variants simply append a static extension to the end of a file (e.g., turning finance.xlsx into finance.xlsx.lockbit). PicMo, however, executes a double-randomization process.

When the payload targets a file, it completely obliterates the original filename, replacing it with a randomly generated 16-character hexadecimal string, and then appends a dynamic, randomized extension that is unique to that specific infection instance.

For example, a file path originally reading: C:\Data\SQL\Production_DB.mdf
Might be transformed into: C:\Data\SQL\56922DCB6BBA1DBB.jHznjwAp

This is a calculated anti-forensic tactic. By stripping the file of its original name and original extension, the attackers make it incredibly difficult for internal IT teams to identify which files are critical, which are system files, and which are user data. If an organization has 500,000 files renamed to random hex strings, simply finding the database file required for business continuity becomes a massive forensic challenge, thereby increasing the pressure to pay the ransom.

4. Execution Chain & Cryptographic Architecture

At its core, the PicMo (Babuk) encryption engine is designed for maximum speed and secure key handling, utilizing a sophisticated hybrid cryptographic algorithm that bypasses traditional RSA limitations.

The ChaCha8 Stream Cipher

For the actual encryption of the file data, PicMo relies on the ChaCha8 stream cipher. ChaCha8 is highly favored by modern malware authors because it is remarkably fast, operates efficiently across multiple CPU threads, and causes minimal disk I/O bottlenecks—allowing the malware to encrypt massive enterprise databases without triggering immediate performance alarms.

Elliptic-Curve Diffie–Hellman (ECDH) Key Exchange

To protect the ChaCha8 symmetric keys, PicMo utilizes Elliptic Curve Cryptography (ECC), specifically the Curve25519 standard. The process unfolds as follows:

1. The ransomware payload contains a hardcoded master public key belonging to the attackers.
2. Upon execution, the malware generates a unique, local public-private key pair for the infected machine using the ECDH protocol.
3. A shared secret is generated mathematically using the local private key and the attacker’s public key.
4. This shared secret is passed through a SHA-256 hashing function to create the final ChaCha8 symmetric keys used to lock the files.
5. The local public key is then embedded into the How To Restore Your Files.txt ransom note as the “Victim ID” or appended to the encrypted file headers.

Because the local private key is immediately discarded from memory after the encryption loop finishes, the only mathematical way to recreate the shared secret (and thus the ChaCha8 decryption key) is by possessing the threat actor’s master private key. However, because this is a Babuk variant, specific implementation flaws in how the malware handles the ChaCha8 nonce (number used once) generation often leave cryptographic vulnerabilities that specialized laboratories can exploit.

5. Extortion Dynamics and Laundering Instructions

The text left behind in How To Restore Your Files.txt is a masterclass in psychological manipulation and advanced cybercriminal operations. The PicMo operators do not just demand money; they attempt to reframe the catastrophic breach as a legitimate B2B transaction.

Evasion of Law Enforcement and KYC/AML Regulations

Perhaps the most sophisticated aspect of the PicMo ransom note is its explicit instructions on how to bypass international Anti-Money Laundering (AML) and Know Your Customer (KYC) regulations. The attackers understand that many cryptocurrency exchanges will block transactions flagged as ransom payments.

They explicitly instruct the victim to lie to brokers: “Communicate any other reason for the purchase, such as: personal investment… buying bitcoin as a gift…” Furthermore, they demand that the victim move the purchased Bitcoin off the regulated exchange and onto an offline, cold storage wallet (like Electrum) before transferring the funds to the attackers. This breaks the chain of custody on the blockchain, making it significantly harder for law enforcement to track or freeze the illicit funds.

Decentralized Communications

To protect their own identities, the operators utilize the Session messaging app. Session is a highly secure, decentralized messenger that uses an onion-routing network. It requires no phone number or metadata to register, meaning the communication channel cannot be subpoenaed or taken down by international police forces, ensuring the extortion negotiations remain completely opaque.

6. Evasion and Anti-Recovery Mechanisms

Prior to encrypting the host, PicMo executes a series of highly destructive system commands designed to strip the victim of any local recovery options:

• Volume Shadow Copy Demolition: The malware executes vssadmin.exe delete shadows /all /quiet and wmic.exe shadowcopy delete to permanently erase native Windows backup points.
• Service Termination: It forcefully stops critical enterprise services (such as sqlservr.exe, msexchange.exe, and veeam.exe) to release file handles, ensuring databases and backup repositories are fully accessible for encryption.
• Security Software Neutralization: Using its escalated privileges, the payload attempts to disable Windows Defender and bypass installed EDR hooks, ensuring the encryption loop runs uninterrupted.

7. Institutional Laboratory Recovery Vectors

Recovering from a PicMo (Babuk variant) deployment without paying an extortionist requires systematic, lab-controlled data restoration methodologies:

• Sector-Level Drive Cloning: All physical and virtual disks are mirrored sector-by-sector using hardware write-blockers. All analysis and file carving tasks take place exclusively on these duplicate images, ensuring the original corrupted state is preserved.
• Cryptographic Flaw Exploitation: Because the Babuk source code is known, forensic engineers analyze the specific payload binary used in the attack. If the attackers compiled the payload using a flawed pseudo-random number generator (PRNG) or failed to properly flush the ChaCha8 keystream from volatile memory, engineers can mathematically reverse the encryption without the private key.
• Unallocated MFT Carving: Ransomware frequently writes new encrypted files to disk before deleting the originals. Intact original file blocks often linger in unallocated Master File Table (MFT) sectors. Deep byte-level carving can extract these pristine files directly from the physical disk platters.
• Database Schema Reconstruction: For large, mission-critical SQL databases that have been stripped of their original .mdf extensions and given random names, specialized laboratory scripts scan the raw disk sectors to identify the untouched 8KB SQL data pages. Engineers bypass the broken, encrypted headers and rebuild the relational database schema into a fresh, fully operational container.