Ransomware Group intelligence
Babuk2
InactiveTrack Babuk2 with 370 published victims and 4 known leak locations in a single intelligence view.
BREACH HOUSE ALERTS
Want an alert every time a new ransomware post is published?
Choose the feeds and the countries you care about — we email you when they move.
Overview
Babuk2 is tracked by Breach House as a ransomware group with 370 published victims.
United States is currently the most targeted country in this dataset.
4 known leak locations are currently associated with this group.
Leak Status Distribution
370
- Leaked 2 0.5%
- Pending 368 99.5%
- Deleted 0 0.0%
Top Countries
Interactive distribution based on the currently visible victims list.
Known Leak Locations (4)
| Label | Type | Availability | Links |
|---|---|---|---|
| Leak location 3 | Web location | Down checked 4h ago | 212.24.99.211. |
| Leak location 2 | Onion service | Down checked 4h ago | bxwu33iefqfc3rxigynn3ghvq4gdw3gxgxna5m4aa3o4vscdeeqhiqad.onion |
| Leak location 4 | Web location | Down checked 4h ago | 5g2e.l.time4vps.cloud |
| Leak location 1 | Onion service | Down checked 4h ago | 7dikawx73goypgfi4zyo5fcajxwb7agemmiwqax3p54aey4dwobcvcyd.onion |
Top Activity Sectors (17)
- Not identified 102
- Services 17
- Public Sector 13
- Communication / Marketing 10
- Healthcare / Pharma 9
- Finance / Legal / Insurance 9
- Retail / E-commerce 6
- Manufacturing / Engineering 5
- IT 5
- Construction / Real Estate 3
- Agriculture / Food 3
- Telecommunications 3
- Energy 2
- Transportation / Travel / Logistics 2
- Education 2
- NGOs / Associations 1
- Hospitality / Food & Beverage / Tourism 1
Typical Attacks (12)
▼MITRE ATT&CK does not currently catalogue Babuk2, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v19.2. Confidence: medium. Treat it as orientation, not attribution.
-
T1059.001 PowerShell Execution
What they do: babuk2 uses PowerShell scripts to execute malicious commands and deploy ransomware payloads across compromised systems.
What that means: Adversaries may abuse PowerShell commands and scripts for execution.
-
What they do: babuk2 modifies Windows Registry Run keys to ensure ransomware execution upon system reboot for persistence.
What that means: Adversaries may interact with the Windows Registry as part of a variety of other techniques to aid in defense evasion, persistence, and execution.
-
What they do: babuk2 leverages registry run keys and startup folders to maintain persistence across reboots.
What that means: Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key.
-
T1685 Disable or Modify Tools Defense Impairment
What they do: babuk2 disables security tools like antivirus software and monitoring agents to evade detection during infection.
What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
-
T1688 Safe Mode Boot Defense Impairment
What they do: babuk2 manipulates boot sequence via Safe Mode Boot techniques to bypass initial security checks during execution.
What that means: Adversaries may abuse Windows safe mode to disable endpoint defenses.
-
T1027.013 Encrypted/Encoded File Stealth
What they do: babuk2 encrypts and encodes victim files with custom ransomware keys to ensure irreversible data access denial.
What that means: Adversaries may encrypt or encode files to obfuscate strings, bytes, and other specific patterns to impede detection.
-
T1070.004 File Deletion Stealth
What they do: babuk2 deletes Volume Shadow Copies and backup files via system commands to prevent data recovery.
What that means: Adversaries may delete files left behind by the actions of their intrusion activity.
-
T1018 Remote System Discovery Discovery
What they do: babuk2 discovers remote systems via network scanning to expand foothold across victim networks.
What that means: Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system.
-
T1135 Network Share Discovery Discovery
What they do: babuk2 performs network share discovery to identify accessible SMB shares for lateral movement and victim targeting.
What that means: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.
-
T1021.002 SMB/Windows Admin Shares Lateral Movement
What they do: babuk2 uses SMB/Windows Admin Shares for lateral movement between compromised hosts within the network.
What that means: Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).
-
T1486 Data Encrypted for Impact Impact
What they do: babuk2 encrypts victim files using strong symmetric encryption to maximize impact and trigger ransom demands.
What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
-
T1490 Inhibit System Recovery Impact
What they do: babuk2 calls system recovery inhibitors like shutdown scripts to prevent victim systems from restoring functionality.
What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.
Victims (370)
Search, filter and paginate the victim timeline for Babuk2. Showing 101–200 of 370.
| Type | Target | Discovered | Country | Business Category | Intel Link | Leak status |
|---|---|---|---|---|---|---|
| Ransomware | 🚀 DB Market – Buy & Sell Databases Safely! id18571 View details | United States | Retail / E-commerce | pending | ||
|
DB Market – Buy & Sell Databases Safely! is presented as a US-based retail and e-commerce entity, and its name suggests a business focused on the buying and selling of databases. In threat-intelligence context, Babuk2 has been documented by multiple analysts as a branding operation that recycles victim names and leak pages rather than a proven original Babuk ransomware revival. Public reporting describes Babuk2 as using copied victim entries and false extortion claims to create the appearance of active ransomware activity. DB Market – Buy & Sell Databases Safely! was listed as a ransomware victim associated with babuk2. |
||||||
| Ransomware | The Ticktin Law Group id18570 View details | United States | Finance / Legal / Insurance | pending | ||
|
The Ticktin Law Group By Babuk Locker 2.0 |
||||||
| Ransomware | The Ticktin Law Group id33023 View details | United States | Finance / Legal / Insurance | pending | ||
|
The Ticktin Law Group By Babuk Locker 2.0 |
||||||
| Ransomware | Mpaj.gov.my id18569 View details | Malaysia | Other | pending | ||
|
Mpaj.gov.my |
||||||
| Ransomware | Mpaj.gov.my id33024 View details | Malaysia | Other | pending | ||
|
Mpaj.gov.my |
||||||
| Ransomware | exostar.com TOP Defense AS id18568 View details | Other | pending | |||
|
exostar.com TOP Defense AS |
||||||
| Ransomware | exostar.com TOP Defense AS id33025 View details | Norway | Other | pending | ||
|
exostar.com TOP Defense AS |
||||||
| Ransomware | Our Official telegram channel babuk Locker 2.0 id18567 View details | United Kingdom | Other | pending | ||
|
Our Official telegram channel babuk Locker 2.0 is a Telegram-based entity located in Great Britain operating within the Other sector. It functions as a platform associated with the Babuk Locker 2.0 ransomware group, which targets victims globally through Telegram channels. The channel is linked to threat actor babuk2, who has published it as a new victim in the ransomware ecosystem. Babuk Locker 2.0 is widely recognized by researchers as a deceptive operation using rebranded LockBit 3.0 code rather than a genuine return of the original group. It was listed as a ransomware victim associated with babuk2. |
||||||
| Ransomware | Standard Capital Securities (Pvt) Backoffice - Pakistan Stock Market Data Vault id18566 View details | Pakistan | Retail / E-commerce | pending | ||
|
Standard Capital Securities (Pvt) Backoffice - Pakistan Stock Market Data Vault |
||||||
| Ransomware | Standard Capital Securities (Pvt) Backoffice - Pakistan Stock Market Data Vault id33026 View details | Pakistan | Retail / E-commerce | pending | ||
|
Standard Capital Securities (Pvt) Backoffice - Pakistan Stock Market Data Vault |
||||||
| Ransomware | mohrss.gov.cn ( Ministry of Human Resources and Social Security ) id18564 View details | China | Public Sector | pending | ||
|
mohrss.gov.cn ( Ministry of Human Resources and Social Security ) |
||||||
| Ransomware | mohrss.gov.cn ( Ministry of Human Resources and Social Security ) id33027 View details | China | Public Sector | pending | ||
|
mohrss.gov.cn ( Ministry of Human Resources and Social Security ) |
||||||
| Ransomware | amazon.com id18563 View details | United States | Other | pending | ||
|
amazon.com |
||||||
| Ransomware | amazon.com id33028 View details | United States | Other | pending | ||
|
amazon.com |
||||||
| Ransomware | fr.sodexo.com id18542 View details | France | Other | pending | ||
|
fr.sodexo.com |
||||||
| Ransomware | fr.sodexo.com id33029 View details | France | Other | pending | ||
|
fr.sodexo.com |
||||||
| Ransomware | Corporate access, up to Shipping Apps in QATAR id18541 View details | Qatar | Transportation / Travel / Logistics | pending | ||
|
Corporate access, up to Shipping Apps in QATAR |
||||||
| Ransomware | Corporate access, up to Shipping Apps in QATAR id33030 View details | Qatar | Transportation / Travel / Logistics | pending | ||
|
Corporate access, up to Shipping Apps in QATAR |
||||||
| Ransomware | woqod.com id18540 View details | Qatar | Other | pending | ||
|
woqod.com |
||||||
| Ransomware | woqod.com id33031 View details | Qatar | Other | pending | ||
|
woqod.com |
||||||
| Ransomware | mof.go.th - Ministry of Finance (Thailand) id18539 View details | Thailand | Finance / Legal / Insurance | pending | ||
|
mof.go.th - Ministry of Finance (Thailand) |
||||||
| Ransomware | mof.go.th - Ministry of Finance (Thailand) id33032 View details | Thailand | Finance / Legal / Insurance | pending | ||
|
mof.go.th - Ministry of Finance (Thailand) |
||||||
| Ransomware | smic.mi.th (Thailand Intelligence Agency) id18534 View details | Thailand | Communication / Marketing | pending | ||
|
smic.mi.th (Thailand Intelligence Agency) |
||||||
| Ransomware | smic.mi.th (Thailand Intelligence Agency) id33033 View details | Thailand | Communication / Marketing | pending | ||
|
smic.mi.th (Thailand Intelligence Agency) |
||||||
| Ransomware | www.gob.ve id18532 View details | Venezuela, Bolivarian Republic of | Other | pending | ||
|
www.gob.ve |
||||||
| Ransomware | www.gob.ve id33034 View details | Venezuela, Bolivarian Republic of | Other | pending | ||
|
www.gob.ve |
||||||
| Ransomware | Access Panel Financial Technology Company (Thailand) id18531 View details | Thailand | IT | pending | ||
|
Access Panel Financial Technology Company (Thailand) |
||||||
| Ransomware | Access Panel Financial Technology Company (Thailand) id33035 View details | Thailand | IT | pending | ||
|
Access Panel Financial Technology Company (Thailand) |
||||||
| Ransomware | United States County Palm Beach Goverment id18530 View details | United States | Public Sector | pending | ||
|
United States County Palm Beach Goverment |
||||||
| Ransomware | United States County Palm Beach Goverment id33036 View details | United States | Public Sector | pending | ||
|
United States County Palm Beach Goverment |
||||||
| Ransomware | Municipal taxation Secretariat Access - Brazil Goverment id18529 View details | Brazil | Public Sector | pending | ||
|
Municipal taxation Secretariat Access - Brazil Goverment |
||||||
| Ransomware | Municipal taxation Secretariat Access - Brazil Goverment id33037 View details | Brazil | Public Sector | pending | ||
|
Municipal taxation Secretariat Access - Brazil Goverment |
||||||
| Ransomware | Intelligence Bureau of the Joint Staff Department of the Central Military Commission... id18528 View details | China | Public Sector | pending | ||
|
Intelligence Bureau of the Joint Staff Department of the Central Military Commission China |
||||||
| Ransomware | Intelligence Bureau of the Joint Staff Department of the Central Military Commission... id33038 View details | China | Public Sector | pending | ||
|
Intelligence Bureau of the Joint Staff Department of the Central Military Commission China |
||||||
| Ransomware | rac.gov.my id18527 View details | Malaysia | Other | pending | ||
|
rac.gov.my |
||||||
| Ransomware | rac.gov.my id33039 View details | Malaysia | Other | pending | ||
|
rac.gov.my |
||||||
| Ransomware | nimapinfotech.com id18526 View details | India | IT | pending | ||
|
nimapinfotech.com |
||||||
| Ransomware | nimapinfotech.com id33040 View details | India | IT | pending | ||
|
nimapinfotech.com |
||||||
| Ransomware | esaote.com id18503 View details | Italy | Other | pending | ||
|
esaote.com |
||||||
| Ransomware | esaote.com id33041 View details | Italy | Other | pending | ||
|
esaote.com |
||||||
| Ransomware | nstda.or.th id18502 View details | Thailand | Other | pending | ||
|
nstda.or.th |
||||||
| Ransomware | nstda.or.th id33042 View details | Thailand | Other | pending | ||
|
nstda.or.th |
||||||
| Ransomware | kominfo.go.id id18501 View details | Indonesia | Other | pending | ||
|
kominfo.go.id |
||||||
| Ransomware | kominfo.go.id id33043 View details | Indonesia | Other | pending | ||
|
kominfo.go.id |
||||||
| Ransomware | pajak.go.id id18500 View details | Indonesia | Other | pending | ||
|
pajak.go.id |
||||||
| Ransomware | pajak.go.id id33044 View details | Indonesia | Other | pending | ||
|
pajak.go.id |
||||||
| Ransomware | dukcapil.kemendagri.go.id (SIAK DUKCAPIL MINISTRY OF HOME AFFAIRS OF INDONESIA) id18499 View details | Indonesia | Agriculture / Food | pending | ||
|
dukcapil.kemendagri.go.id (SIAK DUKCAPIL MINISTRY OF HOME AFFAIRS OF INDONESIA) |
||||||
| Ransomware | dukcapil.kemendagri.go.id (SIAK DUKCAPIL MINISTRY OF HOME AFFAIRS OF INDONESIA) id33045 View details | Indonesia | Agriculture / Food | pending | ||
|
dukcapil.kemendagri.go.id (SIAK DUKCAPIL MINISTRY OF HOME AFFAIRS OF INDONESIA) |
||||||
| Ransomware | whitecapcanada.com id18496 View details | Canada | Other | pending | ||
|
whitecapcanada.com |
||||||
| Ransomware | whitecapcanada.com id33046 View details | Canada | Other | pending | ||
|
whitecapcanada.com |
||||||
| Ransomware | A Buyer Fake Actor BF id18495 View details | Burkina Faso | Other | pending | ||
|
A Buyer Fake Actor BF is a victim listing associated with Babuk2, the group researchers describe as a Babuk-branded extortion operation that reuses stolen data and false victim claims rather than operating as a typical ransomware gang. The entry is tagged to BF and the sector "Other," indicating a non-specific organization profile in the intelligence index. Babuk2 has been reported to post recycled leaks and impersonate a broader ransomware brand to amplify pressure on targets and maximize perceived credibility. It was listed as a ransomware victim associated with babuk2. |
||||||
| Ransomware | hcahealthcare.com INC. id18491 View details | United States | Healthcare / Pharma | leaked | ||
|
hcahealthcare.com INC. |
||||||
| Ransomware | hcahealthcare.com INC. id33047 View details | United States | Healthcare / Pharma | pending | ||
|
hcahealthcare.com INC. |
||||||
| Ransomware | sp.tnitelecom.com id18488 View details | United States | Telecommunications | pending | ||
|
sp.tnitelecom.com |
||||||
| Ransomware | sp.tnitelecom.com id33048 View details | United States | Telecommunications | pending | ||
|
sp.tnitelecom.com |
||||||
| Ransomware | Otelier.io id18487 View details | United States | Other | pending | ||
|
Otelier.io |
||||||
| Ransomware | Otelier.io id33049 View details | United States | Other | pending | ||
|
Otelier.io |
||||||
| Ransomware | highwirepress.com id18484 View details | United States | Communication / Marketing | pending | ||
|
highwirepress.com |
||||||
| Ransomware | highwirepress.com id33050 View details | United States | Communication / Marketing | pending | ||
|
highwirepress.com |
||||||
| Ransomware | taobao.com id18460 View details | China | Other | pending | ||
|
taobao.com |
||||||
| Ransomware | taobao.com id33051 View details | China | Other | pending | ||
|
taobao.com |
||||||
| Ransomware | pinduoduo.com id18459 View details | China | Other | pending | ||
|
Pinduoduo is a mobile-only marketplace that connects millions of agricultural producers with consumers across China, operating as the country's largest agri-focused technology platform. Founded in 2015 by PDD Holdings, it began as a fresh agriculture platform before expanding into a leading social commerce player with significant gross merchandise value. The platform emphasizes value creation for consumers and leverages social features to drive growth in the Chinese ecommerce sector. Pinduoduo was neutrally listed as a ransomware victim associated with the threat actor Babuk2. |
||||||
| Ransomware | This entry has been removed following a request from the company id18492 View details | China | Services | — | pending | |
|
Takedown notice of 18 Mars 2025 - Request #1025 |
||||||
| Ransomware | icmr.gov.in id18457 View details | India | Other | pending | ||
|
icmr.gov.in |
||||||
| Ransomware | icmr.gov.in id33052 View details | India | Other | pending | ||
|
icmr.gov.in |
||||||
| Ransomware | Ministry Of Defense of the Republic Of Korea id18456 View details | Korea, Republic of | Public Sector | pending | ||
|
Ministry Of Defense of the Republic Of Korea |
||||||
| Ransomware | Ministry Of Defense of the Republic Of Korea id33053 View details | Korea, Republic of | Public Sector | pending | ||
|
Ministry Of Defense of the Republic Of Korea |
||||||
| Ransomware | JD.com Inc (Chinese) id18455 View details | China | Services | pending | ||
|
JD.com Inc (Chinese) |
||||||
| Ransomware | JD.com Inc (Chinese) id33054 View details | China | Services | pending | ||
|
JD.com Inc (Chinese) |
||||||
| Ransomware | Florida Department of Transportation (FDOT) id18439 View details | United States | Transportation / Travel / Logistics | pending | ||
|
Florida Department of Transportation (FDOT) |
||||||
| Ransomware | Florida Department of Transportation (FDOT) id33055 View details | United States | Transportation / Travel / Logistics | pending | ||
|
Florida Department of Transportation (FDOT) |
||||||
| Ransomware | Orange.com id18438 View details | France | Other | pending | ||
|
Orange.com |
||||||
| Ransomware | Orange.com id33056 View details | France | Other | pending | ||
|
Orange.com |
||||||
| Ransomware | Belarus E-commerce & Energy Data id18429 View details | Belarus | Retail / E-commerce | pending | ||
|
Belarus E-commerce & Energy Data |
||||||
| Ransomware | Belarus E-commerce & Energy Data id33057 View details | Belarus | Retail / E-commerce | pending | ||
|
Belarus E-commerce & Energy Data |
||||||
| Ransomware | knesset.gov.il id18428 View details | Israel | Other | pending | ||
|
knesset.gov.il |
||||||
| Ransomware | knesset.gov.il id33058 View details | Israel | Other | pending | ||
|
knesset.gov.il |
||||||
| Ransomware | nrru.ac.th - University id18427 View details | Thailand | Education | pending | ||
|
nrru.ac.th - University |
||||||
| Ransomware | nrru.ac.th - University id33059 View details | Thailand | Education | pending | ||
|
nrru.ac.th - University |
||||||
| Ransomware | iaai.com - Washington DC DMV id18418 View details | United States | Other | pending | ||
|
iaai.com - Washington DC DMV |
||||||
| Ransomware | iaai.com - Washington DC DMV id33060 View details | United States | Other | pending | ||
|
iaai.com - Washington DC DMV |
||||||
| Ransomware | access and various companies By babuk Locker 2.0 id18417 View details | United Kingdom | Other | pending | ||
|
Babuk Locker 2.0 is a deceptive 2025 ransomware campaign that falsely claims to be a revival of the original Babuk group but is technically a rebranded version of LockBit 3.0 ransomware. This operation, linked to threat actors Skywave and Bjorka, leverages the notorious Babuk brand name to engage in re-extortion attempts using previously stolen data rather than conducting actual ransomware breaches. The campaign has listed over 100 alleged victims across multiple sectors including energy, manufacturing, IT, and government since January 2025, with victims located in various countries including the United Kingdom. Despite its aggressive claims, technical analysis confirms that Babuk Locker 2.0 lacks the original infrastructure and capabilities of the genuine Babuk operation. The entity was listed as a ransomware victim associated with babuk2. |
||||||
| Ransomware | The Ministry of National Defense - mod.gov.vn (NavyVietnam) id18413 View details | Viet Nam | Public Sector | pending | ||
|
The Ministry of National Defense - mod.gov.vn (NavyVietnam) |
||||||
| Ransomware | The Ministry of National Defense - mod.gov.vn (NavyVietnam) id33061 View details | Viet Nam | Public Sector | pending | ||
|
The Ministry of National Defense - mod.gov.vn (NavyVietnam) |
||||||
| Ransomware | movistar.com.pe id18412 View details | Peru | Other | pending | ||
|
movistar.com.pe |
||||||
| Ransomware | movistar.com.pe id33062 View details | Peru | Other | pending | ||
|
movistar.com.pe |
||||||
| Ransomware | Taiwan - Mackay Hospital id18399 View details | Taiwan, Province of China | Healthcare / Pharma | pending | ||
|
Taiwan - Mackay Hospital |
||||||
| Ransomware | Taiwan - Mackay Hospital id33063 View details | Taiwan, Province of China | Healthcare / Pharma | pending | ||
|
Taiwan - Mackay Hospital |
||||||
| Ransomware | cch.org.tw - Changhua Christian Hospital id18398 View details | Taiwan, Province of China | Healthcare / Pharma | pending | ||
|
cch.org.tw - Changhua Christian Hospital |
||||||
| Ransomware | cch.org.tw - Changhua Christian Hospital id33064 View details | Taiwan, Province of China | Healthcare / Pharma | pending | ||
|
cch.org.tw - Changhua Christian Hospital |
||||||
| Ransomware | nuclep.gov.br. Nuclep Brazil id18397 View details | Brazil | Other | pending | ||
|
nuclep.gov.br. Nuclep Brazil |
||||||
| Ransomware | nuclep.gov.br. Nuclep Brazil id33065 View details | Brazil | Other | pending | ||
|
nuclep.gov.br. Nuclep Brazil |
||||||
| Ransomware | parliament.iq id18396 View details | Iraq | Other | pending | ||
|
parliament.iq By Babuk Locker 2.0 |
||||||
| Ransomware | parliament.iq id33066 View details | Iraq | Other | pending | ||
|
parliament.iq By Babuk Locker 2.0 |
||||||
| Ransomware | web.asia.edu.tw - Taiwan (Asia University) id21591 View details | Taiwan, Province of China | Education | pending | ||
|
web.asia.edu.tw - Taiwan (Asia University) |
||||||
| Ransomware | Intelligence Bureau of the Joint Staff Department of the Central Military Commission China id18394 View details | China | Public Sector | pending | ||
|
Intelligence Bureau of the Joint Staff Department of the Central Military Commission China |
||||||
| Ransomware | Intelligence Bureau of the Joint Staff Department of the Central Military Commission China id33068 View details | China | Public Sector | pending | ||
|
Intelligence Bureau of the Joint Staff Department of the Central Military Commission China |
||||||
| Ransomware | Indian military and government defense 20TB id18393 View details | Public Sector | pending | |||
|
Indian military and government defense 20TB |
||||||
| Ransomware | Indian military and government defense 20TB id33069 View details | India | Public Sector | pending | ||
|
Indian military and government defense 20TB |
||||||
| Ransomware | Iraqi Ministry of Finance id18384 View details | Iraq | Finance / Legal / Insurance | pending | ||
|
Iraqi Ministry of Finance |
||||||