Barracuda Ransomware Recovery: The 2026 Group (Not Barracuda Networks)

A group calling itself Barracuda began posting victims on 6 August 2026 and had listed 16 by 3 November (ransomware.live). They are spread across the United States, Turkey, South Korea, Denmark and Croatia, and are mostly manufacturers, technology companies and healthcare providers. Named victims include the South Korean manufacturer Namyang Industrial, the Turkish software company i2i-systems and a US medical practice group.

The name causes confusion. There is no known connection between this group and Barracuda Networks, the email and network security company, and searches for Barracuda Networks security incidents are a different subject.

The group runs double extortion: it publishes victims and threatens to release their data. Some trackers describe it as a ransomware-as-a-service operation. No technical analysis of its encryptor has been published, so its encryption method, file extension and way in are not publicly confirmed.

No public decryptor exists for the Barracuda group, and none is likely while the group is active. Recovery without the key works from what an encryptor leaves behind: large files such as SQL Server and Oracle databases, VMware and Hyper-V virtual disks and Veeam backup files are often only partly encrypted, because encrypting every byte of a large file takes too long. We measure exactly which regions of each file were encrypted and rebuild the tables, virtual machines and files from the intact parts.

Keep the encrypted files and the ransom note, do not wipe or reinstall the servers, and do not run repair tools on the encrypted files. Contact us for a free assessment. We have solved many cases like this. No data, no charge.