Ransomware Group intelligence
Babuk2
InactiveTrack Babuk2 with 195 published victims and 4 known leak locations in a single intelligence view.
BREACH HOUSE ALERTS
Want an alert every time a new ransomware post is published?
Choose the feeds and the countries you care about — we email you when they move.
Overview
Babuk2 is tracked by Breach House as a ransomware group with 195 published victims.
United States is currently the most targeted country in this dataset.
4 known leak locations are currently associated with this group.
Top Countries
Interactive distribution based on the currently visible victims list.
Known Leak Locations (4)
| Label | Type | Availability | Links |
|---|---|---|---|
| Leak location 3 | Web location | Down checked 2h ago | 212.24.99.211. |
| Leak location 4 | Web location | Down checked 2h ago | 5g2e.l.time4vps.cloud |
| Leak location 2 | Onion service | Down checked 2h ago | bxwu33iefqfc3rxigynn3ghvq4gdw3gxgxna5m4aa3o4vscdeeqhiqad.onion |
| Leak location 1 | Onion service | Down checked 2h ago | 7dikawx73goypgfi4zyo5fcajxwb7agemmiwqax3p54aey4dwobcvcyd.onion |
Top Activity Sectors (17)
- Not identified 102
- Services 17
- Public Sector 13
- Communication / Marketing 10
- Healthcare / Pharma 9
- Finance / Legal / Insurance 9
- Retail / E-commerce 6
- Manufacturing / Engineering 5
- IT 5
- Construction / Real Estate 3
- Agriculture / Food 3
- Telecommunications 3
- Education 3
- Energy 2
- Transportation / Travel / Logistics 2
- NGOs / Associations 1
- Hospitality / Food & Beverage / Tourism 1
Typical Attacks (12)
▼MITRE ATT&CK does not currently catalogue Babuk2, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v19.2. Confidence: medium. Treat it as orientation, not attribution.
-
T1059.001 PowerShell Execution
What they do: babuk2 uses PowerShell scripts to execute malicious commands and deploy ransomware payloads across compromised systems.
What that means: Adversaries may abuse PowerShell commands and scripts for execution.
-
What they do: babuk2 modifies Windows Registry Run keys to ensure ransomware execution upon system reboot for persistence.
What that means: Adversaries may interact with the Windows Registry as part of a variety of other techniques to aid in defense evasion, persistence, and execution.
-
What they do: babuk2 leverages registry run keys and startup folders to maintain persistence across reboots.
What that means: Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key.
-
T1685 Disable or Modify Tools Defense Impairment
What they do: babuk2 disables security tools like antivirus software and monitoring agents to evade detection during infection.
What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
-
T1688 Safe Mode Boot Defense Impairment
What they do: babuk2 manipulates boot sequence via Safe Mode Boot techniques to bypass initial security checks during execution.
What that means: Adversaries may abuse Windows safe mode to disable endpoint defenses.
-
T1027.013 Encrypted/Encoded File Stealth
What they do: babuk2 encrypts and encodes victim files with custom ransomware keys to ensure irreversible data access denial.
What that means: Adversaries may encrypt or encode files to obfuscate strings, bytes, and other specific patterns to impede detection.
-
T1070.004 File Deletion Stealth
What they do: babuk2 deletes Volume Shadow Copies and backup files via system commands to prevent data recovery.
What that means: Adversaries may delete files left behind by the actions of their intrusion activity.
-
T1018 Remote System Discovery Discovery
What they do: babuk2 discovers remote systems via network scanning to expand foothold across victim networks.
What that means: Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system.
-
T1135 Network Share Discovery Discovery
What they do: babuk2 performs network share discovery to identify accessible SMB shares for lateral movement and victim targeting.
What that means: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.
-
T1021.002 SMB/Windows Admin Shares Lateral Movement
What they do: babuk2 uses SMB/Windows Admin Shares for lateral movement between compromised hosts within the network.
What that means: Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).
-
T1486 Data Encrypted for Impact Impact
What they do: babuk2 encrypts victim files using strong symmetric encryption to maximize impact and trigger ransom demands.
What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
-
T1490 Inhibit System Recovery Impact
What they do: babuk2 calls system recovery inhibitors like shutdown scripts to prevent victim systems from restoring functionality.
What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.
Victims (195)
Search, filter and paginate the victim timeline for Babuk2. Showing 101–195 of 195.
| Type | Target | Discovered | Country | Business Category | Intel Link |
|---|---|---|---|---|---|
| Ransomware | parliament.iq id18396 View details | Iraq | Other | ||
|
parliament.iq By Babuk Locker 2.0 |
|||||
| Ransomware | web.asia.edu.tw - Taiwan (Asia University) id21591 View details | Taiwan, Province of China | Education | ||
|
Asia University, Taiwan, is a private higher education institution located in Wufeng, Taichung, offering undergraduate and graduate programs across diverse academic fields. Founded in 2005 by Professor Tsai Chang-hai and Mr. Lin Zeng-lian, the university evolved from Taichung Health and Management College and provides comprehensive student services, including enrollment information, academic scheduling, and campus navigation via its official mobile app. The institution serves students, faculty, and visitors with tools for course registration, financial inquiries, and campus news updates. Asia University, Taiwan, was listed as a ransomware victim associated with Babuk2. |
|||||
| Ransomware | web.asia.edu.tw - Taiwan (Asia University) id29979 View details | Taiwan, Province of China | Education | ||
|
Asia.edu.tw is an educational institution based in Taiwan, operating in the education sector. The institution provides various educational resources and services. Asia.edu.tw was listed as a ransomware victim associated with babuk2 |
|||||
| Ransomware | web.asia.edu.tw - Taiwan (Asia University) id29979 View details | Taiwan, Province of China | Education | ||
|
web.asia.edu.tw - Taiwan (Asia University) |
|||||
| Ransomware | Intelligence Bureau of the Joint Staff Department of the Central Military Commission China id18394 View details | China | Public Sector | ||
|
Intelligence Bureau of the Joint Staff Department of the Central Military Commission China |
|||||
| Ransomware | Indian military and government defense 20TB id18393 View details | Public Sector | |||
|
Indian military and government defense 20TB |
|||||
| Ransomware | Iraqi Ministry of Finance id18384 View details | Iraq | Finance / Legal / Insurance | ||
|
Iraqi Ministry of Finance |
|||||
| Ransomware | Iraqi Council of Ministers id18383 View details | Iraq | Public Sector | ||
|
Iraqi Council of Ministers |
|||||
| Ransomware | marinabaysands.com - Singapore Hotel (Internal Server) id18373 View details | Singapore | Hospitality / Food & Beverage / Tourism | ||
|
marinabaysands.com - Singapore Hotel (Internal Server) |
|||||
| Ransomware | hitekgroup.in india Finance id18368 View details | India | Finance / Legal / Insurance | ||
|
hitekgroup.in india Finance |
|||||
| Ransomware | India's telecommunication network id18362 View details | India | Telecommunications | ||
|
India's telecommunication network |
|||||
| Ransomware | Babuk Locker 2.0 affiliate program 2025 id18358 View details | United Kingdom | Communication / Marketing | ||
|
Babuk Locker 2.0 affiliate program 2025 refers to a 2025 ransomware brand and affiliate-style extortion operation that security researchers describe as a reworked campaign rather than a true Babuk revival. Reporting says it used Telegram channels to recruit affiliates, promote double-extortion services, and publicize alleged victim listings across multiple sectors. The entity is associated with the GB communication and marketing sector in victim-tracking context, reflecting how the listing is cataloged rather than a confirmed public company disclosure. It was listed as a ransomware victim associated with babuk2. |
|||||
| Ransomware | Baykar Turkish defense company C4I and artificial intelligence id18349 View details | Türkiye | Services | ||
|
Baykar Turkish defense company C4I and artificial intelligence By Babuk Locker 2.0 |
|||||
| Ransomware | wapda.gov.pk By Babuk Locker 2.0 id18316 View details | Pakistan | Other | ||
|
wapda.gov.pk is the official website of the Water and Power Development Authority (WAPDA), a Pakistani government-owned public utility agency based in Lahore, Punjab. WAPDA’s mandate covers the development and management of water and hydropower resources in Pakistan. Its online presence supports the authority’s public information, operational, and organizational functions. The entity was listed as a ransomware victim associated with babuk2. |
|||||
| Ransomware | airexplore.aero Company id18325 View details | Slovakia | Services | ||
|
airexplore.aero Company |
|||||
| Ransomware | fnde.gov.br brazilian government id18317 View details | Brazil | Public Sector | ||
|
fnde.gov.br brazilian government |
|||||
| Ransomware | wapda.gov.pk id18321 View details | Pakistan | Other | ||
|
wapda.gov.pk By Babuk Locker 2.0 |
|||||
| Ransomware | lexmark.com Company id18315 View details | United States | Services | ||
|
lexmark.com Company |
|||||
| Ransomware | forvismazars.com.fr ( mazars.fr ) By Babuk Locker 2.0 id18313 View details | France | Other | ||
|
forvismazars.com.fr is the French website of Forvis Mazars, an international partnership headquartered in France. The firm provides audit, accounting, tax, and advisory services to businesses and other organizations, and operates from Levallois-Perret in the Paris area. Forvis Mazars describes itself as an integrated partnership active in more than 100 countries and territories, with a broad professional-services offering. In threat-intelligence indexing, it was listed as a ransomware victim associated with babuk2. |
|||||
| Ransomware | forvismazars.com.fr ( mazars.fr ) id18348 View details | France | Other | ||
|
forvismazars.com.fr ( mazars.fr ) By Babuk Locker 2.0 |
|||||
| Ransomware | petstop.com Company id18311 View details | United States | Services | ||
|
petstop.com Company |
|||||
| Ransomware | misaludhealth.com By Babuk Locker 2.0 id18310 View details | United Kingdom | Healthcare / Pharma | ||
|
misaludhealth.com is the digital platform for MiSalud Health, a San Francisco-based bilingual telehealth provider serving the Latinx community in the United States. The company offers Spanish-first virtual care, including on-demand consultations, same-day appointments, and behavioral health services through employers. Its offerings curate culturally appropriate healthcare services, providing access to U.S. licensed physicians and health coaches via video, phone, and messaging. The platform recently announced a GLP-1 support program to expand inclusive care access. misaludhealth.com was listed as a ransomware victim associated with the threat actor babuk2. |
|||||
| Ransomware | misaludhealth.com id18347 View details | United States | Healthcare / Pharma | ||
|
misaludhealth.com By Babuk Locker 2.0 |
|||||
| Ransomware | bank.pingan.com (CN) By Babuk Locker 2.0 id18309 View details | China | Finance / Legal / Insurance | ||
|
bank.pingan.com is the official website of Ping An Bank Co., Ltd., a Chinese joint-stock commercial bank headquartered in Shenzhen, China. It serves retail and corporate customers with diversified banking services, including online banking, enterprise banking, supply chain finance, and integrated onshore and offshore financial services. The bank operates through a broad branch and outlet network across China and maintains English-language access for digital banking and corporate business information. It was listed as a ransomware victim associated with babuk2. |
|||||
| Ransomware | bank.pingan.com (CN) id18346 View details | China | Finance / Legal / Insurance | ||
|
bank.pingan.com |
|||||
| Ransomware | Access to Indian Ministry of Defence and Military Secret (DRDO) documents By Babuk Locker ... id18308 View details | India | Public Sector | ||
|
Access to Indian Ministry of Defence and Military Secret (DRDO) documents By Babuk Locker 2.0 |
|||||
| Ransomware | Mandarin.com.br By Babuk Locker 2.0 id18305 View details | Brazil | Other | ||
|
Agência Mandarin is a shopper marketing and health marketing agency based in São Paulo, Brazil, specializing in sales conversion through proprietary methodologies. The agency transforms storefront facades into e-commerce access links via revitalization projects, serving clients in retail and health sectors. Founded in 2004 with 11 to 50 employees, it operates from Rua Luís Correia de Melo 92 in São Paulo. The agency was listed as a ransomware victim associated with the threat actor babuk2. |
|||||
| Ransomware | Mandarin.com.br id18345 View details | Brazil | Other | ||
|
Mandarin.com.br |
|||||
| Ransomware | mazars.fr id18296 View details | France | Other | ||
|
mazars.fr company |
|||||
| Ransomware | INDONESIA TAXPAYER IDENTIFICATION NUMBER (NPWP) id16958 View details | Indonesia | Other | ||
|
INDONESIA TAXPAYER IDENTIFICATION NUMBER (NPWP) |
|||||
| Ransomware | MYINDIHOME TELKOM INDONESIA by ( Babuk Locker ) id16956 View details | Indonesia | Other | ||
|
MYINDIHOME TELKOM INDONESIA |
|||||
| Ransomware | MYINDIHOME TELKOM INDONESIA id16951 View details | Indonesia | Other | ||
|
MYINDIHOME TELKOM INDONESIA |
|||||
| Ransomware | MYPERTAMINA INDONESIA id16947 View details | Indonesia | Other | ||
|
MYPERTAMINA INDONESIA |
|||||
| Ransomware | copral.com.br id16936 View details | Brazil | Communication / Marketing | ||
|
Greetings! copral.com.br Today we are posting here the new company, "Copral Comercio e Navegacao LTDA". |
|||||
| Ransomware | human.de id16933 View details | Germany | Communication / Marketing | ||
|
HUMAN, founded in 1972, is a Germany based privately owned company which develops, manufactures and distributes a wide range of IVD Diagnostics and laboratory equipment. |
|||||
| Ransomware | bocagroup.com id16932 View details | United States | Construction / Real Estate | ||
|
As America's premier elevator and escalator consulting company, BOCA Group is the partner of choice for the biggest and best-known building owners and developer |
|||||
| Ransomware | alentec.com id16931 View details | Sweden | Telecommunications | ||
|
This is a public request for Alentec & Orion AB, you don't have much time left to get in touch with us and help you resolve your security problems, we also continue to be in your networks and monitor you |
|||||
| Ransomware | Württemberger Medien id16930 View details | Germany | IT | ||
|
Lassen Sie sich kostenlos von unseren Experten aus Stuttgart beraten. Digitalisierung geht schnell und einfach - Wir haben Lösungen für den Mittelstand! |
|||||
| Ransomware | viacaojacarei.com.br id16929 View details | Brazil | Other | ||
|
viacaojacarei.com.br |
|||||
| Ransomware | gelco-s-a.com.br id16928 View details | Brazil | Other | ||
|
gelco-s-a.com.br |
|||||
| Ransomware | Kurosu & Co.SA - kurosu.com.py id16927 View details | Paraguay | Other | ||
|
Kurosu & Co.SA - kurosu.com.py LEAKED |
|||||
| Ransomware | zapopan.gob.mx id16926 View details | Mexico | Other | ||
|
zapopan.gob |
|||||
| Ransomware | carc.gov.jo id16925 View details | Jordan | Other | ||
|
carc.gov |
|||||
| Ransomware | nhbg.com.co id16924 View details | Colombia | Other | ||
|
nhbg |
|||||
| Ransomware | APMS ( Advanced Physician Management Service LLC id16923 View details | United States | Services | ||
|
APMS ( Advanced Physician Management Service LLC |
|||||
| Ransomware | a top-tier law firm in Workers Compensation Defense! id16922 View details | Finance / Legal / Insurance | |||
|
a top-tier law firm in Workers Compensation Defense! |
|||||
| Ransomware | precisediagnosticspacs.com id16921 View details | United States | Communication / Marketing | ||
|
precisediagnosticspacs.com |
|||||
| Ransomware | zetech.ac.ke id16920 View details | Kenya | IT | ||
|
zetech.ac.ke |
|||||
| Ransomware | maxprofit.mcode.me id16919 View details | Communication / Marketing | |||
|
maxprofit.mcode.me |
|||||
| Ransomware | skopje.gov.mk id16918 View details | North Macedonia | Other | ||
|
skopje.gov.mk |
|||||
| Ransomware | rtdc.gov.mn id16917 View details | Mongolia | Other | ||
|
rtdc.gov.mn access |
|||||
| Ransomware | pbos.gov.pk id16916 View details | Pakistan | Other | ||
|
pbos.gov.pk |
|||||
| Ransomware | abd-ong.org id16915 View details | Spain | Other | ||
|
abd-ong.org |
|||||
| Ransomware | mtgazeta.uz id16914 View details | Uzbekistan | Other | ||
|
mtgazeta.uz |
|||||
| Ransomware | sincorpe.org.br id16913 View details | Brazil | Services | ||
|
sincorpe.org.br |
|||||
| Ransomware | pti.agency id16912 View details | Germany | Communication / Marketing | ||
|
pti.agency |
|||||
| Ransomware | singularanalysts.com id16911 View details | United States | Other | ||
|
singularanalysts.com |
|||||
| Ransomware | gervetusa.com id16910 View details | United States | Other | ||
|
gervetusa.com |
|||||
| Ransomware | workers.com.zm id16909 View details | Zambia | Other | ||
|
workers.com.zm |
|||||
| Ransomware | wacer.com.au id16908 View details | Australia | Other | ||
|
wacer.com.au |
|||||
| Ransomware | thebetareview.com id16907 View details | United States | Other | ||
|
thebetareview.com |
|||||
| Ransomware | senseis.xmp.net id16906 View details | Other | |||
|
senseis.xmp.net |
|||||
| Ransomware | fpsc-anz.com id16905 View details | Australia | Other | ||
|
fpsc-anz.com |
|||||
| Ransomware | mandiricoal.net id16904 View details | India | Other | ||
|
mandiricoal.net |
|||||
| Ransomware | dealplexus.com id16903 View details | India | Other | ||
|
dealplexus.com |
|||||
| Ransomware | bee-insurance.com id16902 View details | United States | Finance / Legal / Insurance | ||
|
bee-insurance.com |
|||||
| Ransomware | lamundialdeseguros.com id16901 View details | Colombia | Other | ||
|
lamundialdeseguros.com |
|||||
| Ransomware | indianaerospaceandengineering.com id16900 View details | United States | Manufacturing / Engineering | ||
|
indianaerospaceandengineering.com |
|||||
| Ransomware | gstpam.org id16899 View details | Other | |||
|
gstpam.org |
|||||
| Ransomware | www.shootinghouse.com.br id16898 View details | Brazil | Other | ||
|
www.shootinghouse.com.br |
|||||
| Ransomware | headwaterco.com id16897 View details | United States | Other | ||
|
headwaterco.com |
|||||
| Ransomware | www.al-shefafarm.ro id16896 View details | Romania | Agriculture / Food | ||
|
www.al-shefafarm.ro |
|||||
| Ransomware | www.ykp.com.br id16895 View details | Brazil | Other | ||
|
www.ykp.com.br |
|||||
| Ransomware | www.go4kora.tv id16894 View details | Tuvalu | Other | ||
|
www.go4kora.tv |
|||||
| Ransomware | www.rekamy.com id16893 View details | Malaysia | Other | ||
|
www.rekamy.com |
|||||
| Ransomware | www.dvttechnologyltd.com id16892 View details | United States | IT | ||
|
www.dvttechnologyltd.com |
|||||
| Ransomware | www.siea.sk id16891 View details | Slovakia | Other | ||
|
www.siea.sk |
|||||
| Ransomware | www.spmundi.com.br id16890 View details | Brazil | Other | ||
|
www.spmundi.com.br |
|||||
| Ransomware | www.merchant.id id16889 View details | Indonesia | Other | ||
|
www.merchant.id |
|||||
| Ransomware | www.cyncsolutions.com id16888 View details | United States | Services | ||
|
www.cyncsolutions.com |
|||||
| Ransomware | Baca County Feedyard, Inc id16887 View details | United States | Public Sector | ||
|
Baca County Feedyard, Inc |
|||||
| Ransomware | www.skywaycoach.ca id16886 View details | Canada | Other | ||
|
www.skywaycoach.ca |
|||||
| Ransomware | www.farmaciaflorio.com id16885 View details | Italy | Agriculture / Food | ||
|
www.farmaciaflorio.com |
|||||
| Ransomware | www.nrshealthcare.com id16884 View details | United Kingdom | Healthcare / Pharma | ||
|
www.nrshealthcare.com |
|||||
| Ransomware | www.hcisystems.net id16883 View details | United States | Services | ||
|
www.hcisystems.net |
|||||
| Ransomware | www.betteraccountingsolutions.com id16882 View details | United States | Finance / Legal / Insurance | ||
|
www.betteraccountingsolutions.com |
|||||
| Ransomware | www.aretusamilano.it id16881 View details | Italy | Other | ||
|
www.aretusamilano.it |
|||||
| Ransomware | www.agenciahost.com id16880 View details | Brazil | Other | ||
|
www.agenciahost.com |
|||||
| Ransomware | www.constelacion.com.sv id16879 View details | El Salvador | Other | ||
|
www.constelacion.com.sv |
|||||
| Ransomware | www.avantit.no id16878 View details | Norway | Other | ||
|
www.avantit.no |
|||||
| Ransomware | www.industrialdealimentos.com id16877 View details | Colombia | Manufacturing / Engineering | ||
|
www.industrialdealimentos.com |
|||||
| Ransomware | www.lapastina.com id16876 View details | Brazil | Other | ||
|
www.lapastina.com |
|||||
| Ransomware | www.kovra.com.my id16875 View details | Malaysia | Other | ||
|
www.kovra.com.my |
|||||
| Ransomware | www.computan.com id16874 View details | Canada | Other | ||
|
www.computan.com |
|||||
| Ransomware | www.scadea.com id16873 View details | United States | Other | ||
|
www.scadea.com |
|||||