Babuk2

tecnologias.mspz2.gob.ec ID 19320

turkish defense military ID 18945

rheinmetall.com (Rheinmetall Defence) ID 18944

gangotreehomes.com (RealEstate) ID 18941

Secret plans of Indian army ID 18940

Bangladesh Armed Forces (BangLadesh Army) ID 18939

Saudi Arabian military and government internal center ID 18938

Hellenic Airforce ID 18937

ezbuy.sg (Singapore Shopping) ID 18934

Iran gas service system, ID 18933

kfar hatta medical center - Lebanon ID 18932

Polizia italia mail access ID 18930

zalora.sg (Singapore Shopping) ID 18929

ascires.com ID 18920

aosense.com - AO Sense INC. ID 18919

dardoc.com ID 18918

navy-mil-bd ID 18916

drdo.gov.in ID 18901

uniproof.com.br ID 18900

(UPDATE) - whitecapcanada.com ID 18897

pln.co.id - PLN INDONESIA ID 18861

moh.gov.rw ID 18860

iDRAC (Integrated Dell Remote Access Controller) management interface for Dell servers ID 18795

elsoms.com ID 18782

brune.com.br - Group MC (conglomerate) ID 18781

towellengineering.net ID 18780

icvc.co - Instituto Cardiovascular del Cesar ID 18779

modiin-ezrachi.co.il ID 18778

La Futura ID 18777

Atlantic Coast Consulting Inc ID 18776

theeyeclinicsurgicenter.com - The Eye Clinic Surgicenter company ID 18775

🚀 Launch Your Own Ransomware(RAAS) Business with Our Exclusive Ransomware Panel Source Cod... is a Services-sector entity named in threat-intelligence listings as a ransomware victim. The title suggests a RaaS-themed offering or storefront, but the available source material does not provide confirmed public details about its location, products, or operating footprint. In ransomware-as-a-service ecosystems, operators typically provide malware, infrastructure, and affiliate tooling to customers or partners, but no source here verifies that this entity actually operated such a platform. It was listed as a ransomware victim associated with babuk2. ID 18773

leadzen.ai ID 18764

healthcasts.com ID 18763

pureincubation.com ID 18762

unired.uz ID 18759

nadra.gov.pk - NADRA official Of Pakistan Army & (Andhra Pradesh) ID 18739

nadra.gov.pk is the official website of Pakistan’s National Database and Registration Authority (NADRA), an autonomous government body under the Interior Secretary of Pakistan. NADRA manages national registration databases and provides identity and citizen-registration services, including Computerised National Identity Cards, through its public-facing online and service channels. Based in Islamabad, it serves a nationwide public-sector role within Pakistan’s government administration. The listing identified nadra.gov.pk as a ransomware victim associated with babuk2. ID 18738

heras.co.uk ID 18736

alliedwoundcare.com ID 18735

crimsgroup.com ID 18734

aman-iraq.com ID 18733

mot.gov.iq - Iraqi Ministry of Commerce (Of Trade) ID 18723

israel Infrastructure & Secret Documents intelligence information ID 18722

kalesavunma.com - KALE SAVUNMA. ID 18708

airexplore.aero ID 18667

iberdrola.com (Spain energy) ID 18662

Synesis Surveillance System ID 18604

inmarsat.com ID 18603

jp-property.com ID 18602

armetal.com ID 18598

DB Market – Buy & Sell Databases Safely! is presented as a US-based retail and e-commerce entity, and its name suggests a business focused on the buying and selling of databases. In threat-intelligence context, Babuk2 has been documented by multiple analysts as a branding operation that recycles victim names and leak pages rather than a proven original Babuk ransomware revival. Public reporting describes Babuk2 as using copied victim entries and false extortion claims to create the appearance of active ransomware activity. DB Market – Buy & Sell Databases Safely! was listed as a ransomware victim associated with babuk2. ID 18571

The Ticktin Law Group By Babuk Locker 2.0 ID 18570

Mpaj.gov.my ID 18569

exostar.com TOP Defense AS ID 18568

Our Official telegram channel babuk Locker 2.0 is a Telegram-based entity located in Great Britain operating within the Other sector. It functions as a platform associated with the Babuk Locker 2.0 ransomware group, which targets victims globally through Telegram channels. The channel is linked to threat actor babuk2, who has published it as a new victim in the ransomware ecosystem. Babuk Locker 2.0 is widely recognized by researchers as a deceptive operation using rebranded LockBit 3.0 code rather than a genuine return of the original group. It was listed as a ransomware victim associated with babuk2. ID 18567

Standard Capital Securities (Pvt) Backoffice - Pakistan Stock Market Data Vault ID 18566

mohrss.gov.cn ( Ministry of Human Resources and Social Security ) ID 18564

amazon.com ID 18563

fr.sodexo.com ID 18542

Corporate access, up to Shipping Apps in QATAR ID 18541

woqod.com ID 18540

mof.go.th - Ministry of Finance (Thailand) ID 18539

smic.mi.th (Thailand Intelligence Agency) ID 18534

www.gob.ve ID 18532

Access Panel Financial Technology Company (Thailand) ID 18531

United States County Palm Beach Goverment ID 18530

Municipal taxation Secretariat Access - Brazil Goverment ID 18529

Intelligence Bureau of the Joint Staff Department of the Central Military Commission China ID 18528

rac.gov.my ID 18527

nimapinfotech.com ID 18526

esaote.com ID 18503

nstda.or.th ID 18502

kominfo.go.id ID 18501

pajak.go.id ID 18500

dukcapil.kemendagri.go.id (SIAK DUKCAPIL MINISTRY OF HOME AFFAIRS OF INDONESIA) ID 18499

whitecapcanada.com ID 18496

A Buyer Fake Actor BF is a victim listing associated with Babuk2, the group researchers describe as a Babuk-branded extortion operation that reuses stolen data and false victim claims rather than operating as a typical ransomware gang. The entry is tagged to BF and the sector "Other," indicating a non-specific organization profile in the intelligence index. Babuk2 has been reported to post recycled leaks and impersonate a broader ransomware brand to amplify pressure on targets and maximize perceived credibility. It was listed as a ransomware victim associated with babuk2. ID 18495

hcahealthcare.com INC. ID 18491

sp.tnitelecom.com ID 18488

Otelier.io ID 18487

highwirepress.com ID 18484

taobao.com ID 18460

Pinduoduo is a mobile-only marketplace that connects millions of agricultural producers with consumers across China, operating as the country's largest agri-focused technology platform. Founded in 2015 by PDD Holdings, it began as a fresh agriculture platform before expanding into a leading social commerce player with significant gross merchandise value. The platform emphasizes value creation for consumers and leverages social features to drive growth in the Chinese ecommerce sector. Pinduoduo was neutrally listed as a ransomware victim associated with the threat actor Babuk2. ID 18459

Takedown notice of 18 Mars 2025 - Request #1025 ID 18492

icmr.gov.in ID 18457

Ministry Of Defense of the Republic Of Korea ID 18456

JD.com Inc (Chinese) ID 18455

Florida Department of Transportation (FDOT) ID 18439

Orange.com ID 18438

Belarus E-commerce & Energy Data ID 18429

knesset.gov.il ID 18428

nrru.ac.th - University ID 18427

iaai.com - Washington DC DMV ID 18418

Babuk Locker 2.0 is a deceptive 2025 ransomware campaign that falsely claims to be a revival of the original Babuk group but is technically a rebranded version of LockBit 3.0 ransomware. This operation, linked to threat actors Skywave and Bjorka, leverages the notorious Babuk brand name to engage in re-extortion attempts using previously stolen data rather than conducting actual ransomware breaches. The campaign has listed over 100 alleged victims across multiple sectors including energy, manufacturing, IT, and government since January 2025, with victims located in various countries including the United Kingdom. Despite its aggressive claims, technical analysis confirms that Babuk Locker 2.0 lacks the original infrastructure and capabilities of the genuine Babuk operation. The entity was listed as a ransomware victim associated with babuk2. ID 18417

The Ministry of National Defense - mod.gov.vn (NavyVietnam) ID 18413

movistar.com.pe ID 18412

Taiwan - Mackay Hospital ID 18399

cch.org.tw - Changhua Christian Hospital ID 18398

nuclep.gov.br. Nuclep Brazil ID 18397