Mimic ‘backmyfiles@tuta.com’ Ransomware

In our recovery lab today at Lockbit Decryptor, we isolated a ransomware strain using the .backmyfiles@tuta.com.backmyfiles extension. Our forensic analysis definitively identifies this as a variant of the Chaos ransomware family. This strain employs a stream cipher for encryption but suffers from a critical operational flaw: in many instances, it fails to complete the encryption…