Add BARADAI ransomware attack flow

[Deniztktk]

Summary

This pull request adds a defensive, source-bounded Attack Flow for BARADAI ransomware based on variant-specific public reporting.

The flow models the earliest publicly reported post-compromise behaviors through the final encryption impact. Public sources do not currently confirm BARADAI's initial-access vector or provide a complete public binary-level reverse-engineering analysis, so the flow does not speculate beyond the available evidence.

Included behaviors

The flow documents:

• scripted command execution through cmd.exe,
• autorun through CurrentVersion\Run registry keys,
• operational or state-data storage under HKCU\SOFTWARE,
• interactions with Internet Settings and policy keys,
• broad file-system reach across drives and directories,
• potential reach into accessible network resources,
• Restart Manager-related handling for file locks,
• termination of SQL and related services using taskkill or net stop,
• deletion of files and artefacts to hinder recovery and reduce forensic traces,
• and final file encryption with the .BARADAI extension and ransom-note delivery.

Sources

• PCrisk — BARADAI Ransomware Analysis
  https://www.pcrisk.com/removal-guides/35238-baradai-ransomware

• CYFIRMA — Weekly Intelligence Report: BARADAI Ransomware
  https://www.cyfirma.com/news/weekly-intelligence-report-08-may-2026/

• CISA — #StopRansomware: MedusaLocker (AA22-181A)
  https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-181a

Evidence boundary

The flow intentionally excludes sibling-variant behaviors unless they are independently reported for BARADAI.

Actions derived from CYFIRMA reporting are marked Probable because a complete public BARADAI binary-level reverse-engineering analysis is not currently available.

The final encryption impact is marked Very Probable because the .BARADAI extension and ransom-note behavior are directly documented in public BARADAI reporting.

Feedback requested

This is submitted as a draft pull request. Maintainer feedback on the modeled post-compromise sequence, evidence boundaries, and any preferred corpus adjustments would be appreciated.