4AGcf is a Babuk-based ransomware variant. It adds .4AGcf to encrypted files and drops How To Restore Your Files.txt, matching the note name the original Babuk payload uses. Its message sets a three-day deadline for contact. The attackers claim to hold stolen emails, financial data and contacts. It is built from the leaked Babuk code rather than run by the 2021 Babuk group.
Decryptor: Decryptor availability has not been recorded.
The ransomware identification tool didn’t load. This is usually temporary — please refresh. If you’re dealing with an active incident, don’t wait on it:
Emergency response: +1 (877) 364-5161