Crucio-derived BigBang Ransomware Module File Encryption (.candy Extension)

Duo Tech@duotech

•updated Jul 21, 2026•1•0•2

Detects file creation events with the .candy extension, consistent with the GigaWiper/Crucio-derived BigBang extortion module (BigBangExtortMain, bigBangSingleFileExtortion, bigBangHybridEncryption) which AES-CBC encrypts files using randomly generated, unsaved key/IV pairs across enumerated Windows logical drives before deleting the original file with os.Remove.