BlueSky Ransomware Uses Conti-Like Multithreaded Encryption and Babuk-Style Crypto

Researchers detailed BlueSky, an emerging Windows ransomware family that rapidly encrypts files through a multithreaded design and uses anti-analysis features plus a staged PowerShell infection chain. The malware was observed being delivered from kmsauto[.]us via start.ps1 and stage.ps1, then saved locally as javaw.exe. It attempts privilege escalation with JuicyPotato on older Windows systems and uses exploits for CVE-2020-0796 and CVE-2021-1732 on newer hosts before encrypting files, appending the .bluesky extension, and dropping ransom notes named # DECRYPT FILES BLUESKY #.txt and # DECRYPT FILES BLUESKY #.html.

Technical analysis found BlueSky shares strong code similarities with Conti v3, particularly in its multithreaded architecture and network share enumeration, while its cryptography aligns more closely with Babuk through the use of ChaCha20 for file encryption and Curve25519 for key generation. The ransomware excludes selected extensions and directories, creates host-specific identifiers, and stores encryption-state artifacts including a mutex and HKCU\Software\<32-byte ID> registry entries. Investigators also found RedLine-related samples hosted on the same domain, indicating possible infrastructure overlap or operational ties even though no direct code overlap was identified.