Ransomware Group intelligence
Babuk2
InactiveTrack Babuk2 with 195 published victims and 4 known leak locations in a single intelligence view.
Overview
Babuk2 is tracked by Breach House as a ransomware group with 195 published victims.
United States is currently the most targeted country in this dataset.
4 known leak locations are currently associated with this group.
Top Countries
Interactive distribution based on the currently visible victims list.
Known Leak Locations (4)
| Label | Type | Availability | Links |
|---|---|---|---|
| Leak location 1 | Onion service | Unknown | 7dikawx73goypgfi4zyo5fcajxwb7agemmiwqax3p54aey4dwobcvcyd.onion |
| Leak location 2 | Onion service | Unknown | bxwu33iefqfc3rxigynn3ghvq4gdw3gxgxna5m4aa3o4vscdeeqhiqad.onion |
| Leak location 3 | Web location | Unknown | 212.24.99.211. |
| Leak location 4 | Web location | Unknown | 5g2e.l.time4vps.cloud |
Top Activity Sectors
No sector intelligence available.
Ransom Notes (0)
▼No ransom notes available for this group.
Tools Used
▼No tools used available.
YARA Rules (0)
▼No YARA rules available.
Indicators of Compromise (0)
▼No IoCs available for this group.
Negotiation Chats (0)
▼No negotiation chats available.
Research Sources
No external research sources linked yet.
Victims (195)
Search, filter and paginate the victim timeline for Babuk2. Showing 101–195 of 195.
| Type | Target | Discovered | Country | Business Category | Intel Link |
|---|---|---|---|---|---|
| Ransomware | parliament.iq id18396 View details | Iraq | Other | ||
|
parliament.iq By Babuk Locker 2.0 |
|||||
| Ransomware | web.asia.edu.tw - Taiwan (Asia University) id21591 View details | Taiwan, Province of China | Education | ||
|
Asia University, Taiwan, is a private higher education institution located in Wufeng, Taichung, offering undergraduate and graduate programs across diverse academic fields. Founded in 2005 by Professor Tsai Chang-hai and Mr. Lin Zeng-lian, the university evolved from Taichung Health and Management College and provides comprehensive student services, including enrollment information, academic scheduling, and campus navigation via its official mobile app. The institution serves students, faculty, and visitors with tools for course registration, financial inquiries, and campus news updates. Asia University, Taiwan, was listed as a ransomware victim associated with Babuk2. |
|||||
| Ransomware | web.asia.edu.tw - Taiwan (Asia University) id29979 View details | Taiwan, Province of China | Education | ||
|
Asia.edu.tw is an educational institution based in Taiwan, operating in the education sector. The institution provides various educational resources and services. Asia.edu.tw was listed as a ransomware victim associated with babuk2 |
|||||
| Ransomware | web.asia.edu.tw - Taiwan (Asia University) id29979 View details | Taiwan, Province of China | Education | ||
|
web.asia.edu.tw - Taiwan (Asia University) |
|||||
| Ransomware | Intelligence Bureau of the Joint Staff Department of the Central Military Commission China id18394 View details | China | Public Sector | ||
|
Intelligence Bureau of the Joint Staff Department of the Central Military Commission China |
|||||
| Ransomware | Indian military and government defense 20TB id18393 View details | Public Sector | |||
|
Indian military and government defense 20TB |
|||||
| Ransomware | Iraqi Ministry of Finance id18384 View details | Iraq | Finance / Legal / Insurance | ||
|
Iraqi Ministry of Finance |
|||||
| Ransomware | Iraqi Council of Ministers id18383 View details | Iraq | Public Sector | ||
|
Iraqi Council of Ministers |
|||||
| Ransomware | marinabaysands.com - Singapore Hotel (Internal Server) id18373 View details | Singapore | Hospitality / Food & Beverage / Tourism | ||
|
marinabaysands.com - Singapore Hotel (Internal Server) |
|||||
| Ransomware | hitekgroup.in india Finance id18368 View details | India | Finance / Legal / Insurance | ||
|
hitekgroup.in india Finance |
|||||
| Ransomware | India's telecommunication network id18362 View details | India | Telecommunications | ||
|
India's telecommunication network |
|||||
| Ransomware | Babuk Locker 2.0 affiliate program 2025 id18358 View details | United Kingdom | Communication / Marketing | ||
|
Babuk Locker 2.0 affiliate program 2025 refers to a 2025 ransomware brand and affiliate-style extortion operation that security researchers describe as a reworked campaign rather than a true Babuk revival. Reporting says it used Telegram channels to recruit affiliates, promote double-extortion services, and publicize alleged victim listings across multiple sectors. The entity is associated with the GB communication and marketing sector in victim-tracking context, reflecting how the listing is cataloged rather than a confirmed public company disclosure. It was listed as a ransomware victim associated with babuk2. |
|||||
| Ransomware | Baykar Turkish defense company C4I and artificial intelligence id18349 View details | Türkiye | Services | ||
|
Baykar Turkish defense company C4I and artificial intelligence By Babuk Locker 2.0 |
|||||
| Ransomware | wapda.gov.pk By Babuk Locker 2.0 id18316 View details | Pakistan | Other | ||
|
wapda.gov.pk is the official website of the Water and Power Development Authority (WAPDA), a Pakistani government-owned public utility agency based in Lahore, Punjab. WAPDA’s mandate covers the development and management of water and hydropower resources in Pakistan. Its online presence supports the authority’s public information, operational, and organizational functions. The entity was listed as a ransomware victim associated with babuk2. |
|||||
| Ransomware | airexplore.aero Company id18325 View details | Slovakia | Services | ||
|
airexplore.aero Company |
|||||
| Ransomware | fnde.gov.br brazilian government id18317 View details | Brazil | Public Sector | ||
|
fnde.gov.br brazilian government |
|||||
| Ransomware | wapda.gov.pk id18321 View details | Pakistan | Other | ||
|
wapda.gov.pk By Babuk Locker 2.0 |
|||||
| Ransomware | lexmark.com Company id18315 View details | United States | Services | ||
|
lexmark.com Company |
|||||
| Ransomware | forvismazars.com.fr ( mazars.fr ) By Babuk Locker 2.0 id18313 View details | France | Other | ||
|
forvismazars.com.fr is the French website of Forvis Mazars, an international partnership headquartered in France. The firm provides audit, accounting, tax, and advisory services to businesses and other organizations, and operates from Levallois-Perret in the Paris area. Forvis Mazars describes itself as an integrated partnership active in more than 100 countries and territories, with a broad professional-services offering. In threat-intelligence indexing, it was listed as a ransomware victim associated with babuk2. |
|||||
| Ransomware | forvismazars.com.fr ( mazars.fr ) id18348 View details | France | Other | ||
|
forvismazars.com.fr ( mazars.fr ) By Babuk Locker 2.0 |
|||||
| Ransomware | petstop.com Company id18311 View details | United States | Services | ||
|
petstop.com Company |
|||||
| Ransomware | misaludhealth.com By Babuk Locker 2.0 id18310 View details | United Kingdom | Healthcare / Pharma | ||
|
misaludhealth.com is the digital platform for MiSalud Health, a San Francisco-based bilingual telehealth provider serving the Latinx community in the United States. The company offers Spanish-first virtual care, including on-demand consultations, same-day appointments, and behavioral health services through employers. Its offerings curate culturally appropriate healthcare services, providing access to U.S. licensed physicians and health coaches via video, phone, and messaging. The platform recently announced a GLP-1 support program to expand inclusive care access. misaludhealth.com was listed as a ransomware victim associated with the threat actor babuk2. |
|||||
| Ransomware | misaludhealth.com id18347 View details | United States | Healthcare / Pharma | ||
|
misaludhealth.com By Babuk Locker 2.0 |
|||||
| Ransomware | bank.pingan.com (CN) By Babuk Locker 2.0 id18309 View details | China | Finance / Legal / Insurance | ||
|
bank.pingan.com is the official website of Ping An Bank Co., Ltd., a Chinese joint-stock commercial bank headquartered in Shenzhen, China. It serves retail and corporate customers with diversified banking services, including online banking, enterprise banking, supply chain finance, and integrated onshore and offshore financial services. The bank operates through a broad branch and outlet network across China and maintains English-language access for digital banking and corporate business information. It was listed as a ransomware victim associated with babuk2. |
|||||
| Ransomware | bank.pingan.com (CN) id18346 View details | China | Finance / Legal / Insurance | ||
|
bank.pingan.com |
|||||
| Ransomware | Access to Indian Ministry of Defence and Military Secret (DRDO) documents By Babuk Locker ... id18308 View details | India | Public Sector | ||
|
Access to Indian Ministry of Defence and Military Secret (DRDO) documents By Babuk Locker 2.0 |
|||||
| Ransomware | Mandarin.com.br By Babuk Locker 2.0 id18305 View details | Brazil | Other | ||
|
Agência Mandarin is a shopper marketing and health marketing agency based in São Paulo, Brazil, specializing in sales conversion through proprietary methodologies. The agency transforms storefront facades into e-commerce access links via revitalization projects, serving clients in retail and health sectors. Founded in 2004 with 11 to 50 employees, it operates from Rua Luís Correia de Melo 92 in São Paulo. The agency was listed as a ransomware victim associated with the threat actor babuk2. |
|||||
| Ransomware | Mandarin.com.br id18345 View details | Brazil | Other | ||
|
Mandarin.com.br |
|||||
| Ransomware | mazars.fr id18296 View details | France | Other | ||
|
mazars.fr company |
|||||
| Ransomware | INDONESIA TAXPAYER IDENTIFICATION NUMBER (NPWP) id16958 View details | Indonesia | Other | ||
|
INDONESIA TAXPAYER IDENTIFICATION NUMBER (NPWP) |
|||||
| Ransomware | MYINDIHOME TELKOM INDONESIA by ( Babuk Locker ) id16956 View details | Indonesia | Other | ||
|
MYINDIHOME TELKOM INDONESIA |
|||||
| Ransomware | MYINDIHOME TELKOM INDONESIA id16951 View details | Indonesia | Other | ||
|
MYINDIHOME TELKOM INDONESIA |
|||||
| Ransomware | MYPERTAMINA INDONESIA id16947 View details | Indonesia | Other | ||
|
MYPERTAMINA INDONESIA |
|||||
| Ransomware | copral.com.br id16936 View details | Brazil | Communication / Marketing | ||
|
Greetings! copral.com.br Today we are posting here the new company, "Copral Comercio e Navegacao LTDA". |
|||||
| Ransomware | human.de id16933 View details | Germany | Communication / Marketing | ||
|
HUMAN, founded in 1972, is a Germany based privately owned company which develops, manufactures and distributes a wide range of IVD Diagnostics and laboratory equipment. |
|||||
| Ransomware | bocagroup.com id16932 View details | United States | Construction / Real Estate | ||
|
As America's premier elevator and escalator consulting company, BOCA Group is the partner of choice for the biggest and best-known building owners and developer |
|||||
| Ransomware | alentec.com id16931 View details | Sweden | Telecommunications | ||
|
This is a public request for Alentec & Orion AB, you don't have much time left to get in touch with us and help you resolve your security problems, we also continue to be in your networks and monitor you |
|||||
| Ransomware | Württemberger Medien id16930 View details | Germany | IT | ||
|
Lassen Sie sich kostenlos von unseren Experten aus Stuttgart beraten. Digitalisierung geht schnell und einfach - Wir haben Lösungen für den Mittelstand! |
|||||
| Ransomware | viacaojacarei.com.br id16929 View details | Brazil | Other | ||
|
viacaojacarei.com.br |
|||||
| Ransomware | gelco-s-a.com.br id16928 View details | Brazil | Other | ||
|
gelco-s-a.com.br |
|||||
| Ransomware | Kurosu & Co.SA - kurosu.com.py id16927 View details | Paraguay | Other | ||
|
Kurosu & Co.SA - kurosu.com.py LEAKED |
|||||
| Ransomware | zapopan.gob.mx id16926 View details | Mexico | Other | ||
|
zapopan.gob |
|||||
| Ransomware | carc.gov.jo id16925 View details | Jordan | Other | ||
|
carc.gov |
|||||
| Ransomware | nhbg.com.co id16924 View details | Colombia | Other | ||
|
nhbg |
|||||
| Ransomware | APMS ( Advanced Physician Management Service LLC id16923 View details | United States | Services | ||
|
APMS ( Advanced Physician Management Service LLC |
|||||
| Ransomware | a top-tier law firm in Workers Compensation Defense! id16922 View details | Finance / Legal / Insurance | |||
|
a top-tier law firm in Workers Compensation Defense! |
|||||
| Ransomware | precisediagnosticspacs.com id16921 View details | United States | Communication / Marketing | ||
|
precisediagnosticspacs.com |
|||||
| Ransomware | zetech.ac.ke id16920 View details | Kenya | IT | ||
|
zetech.ac.ke |
|||||
| Ransomware | maxprofit.mcode.me id16919 View details | Communication / Marketing | |||
|
maxprofit.mcode.me |
|||||
| Ransomware | skopje.gov.mk id16918 View details | North Macedonia | Other | ||
|
skopje.gov.mk |
|||||
| Ransomware | rtdc.gov.mn id16917 View details | Mongolia | Other | ||
|
rtdc.gov.mn access |
|||||
| Ransomware | pbos.gov.pk id16916 View details | Pakistan | Other | ||
|
pbos.gov.pk |
|||||
| Ransomware | abd-ong.org id16915 View details | Spain | Other | ||
|
abd-ong.org |
|||||
| Ransomware | mtgazeta.uz id16914 View details | Uzbekistan | Other | ||
|
mtgazeta.uz |
|||||
| Ransomware | sincorpe.org.br id16913 View details | Brazil | Services | ||
|
sincorpe.org.br |
|||||
| Ransomware | pti.agency id16912 View details | Germany | Communication / Marketing | ||
|
pti.agency |
|||||
| Ransomware | singularanalysts.com id16911 View details | United States | Other | ||
|
singularanalysts.com |
|||||
| Ransomware | gervetusa.com id16910 View details | United States | Other | ||
|
gervetusa.com |
|||||
| Ransomware | workers.com.zm id16909 View details | Zambia | Other | ||
|
workers.com.zm |
|||||
| Ransomware | wacer.com.au id16908 View details | Australia | Other | ||
|
wacer.com.au |
|||||
| Ransomware | thebetareview.com id16907 View details | United States | Other | ||
|
thebetareview.com |
|||||
| Ransomware | senseis.xmp.net id16906 View details | Other | |||
|
senseis.xmp.net |
|||||
| Ransomware | fpsc-anz.com id16905 View details | Australia | Other | ||
|
fpsc-anz.com |
|||||
| Ransomware | mandiricoal.net id16904 View details | India | Other | ||
|
mandiricoal.net |
|||||
| Ransomware | dealplexus.com id16903 View details | India | Other | ||
|
dealplexus.com |
|||||
| Ransomware | bee-insurance.com id16902 View details | United States | Finance / Legal / Insurance | ||
|
bee-insurance.com |
|||||
| Ransomware | lamundialdeseguros.com id16901 View details | Colombia | Other | ||
|
lamundialdeseguros.com |
|||||
| Ransomware | indianaerospaceandengineering.com id16900 View details | United States | Manufacturing / Engineering | ||
|
indianaerospaceandengineering.com |
|||||
| Ransomware | gstpam.org id16899 View details | Other | |||
|
gstpam.org |
|||||
| Ransomware | www.shootinghouse.com.br id16898 View details | Brazil | Other | ||
|
www.shootinghouse.com.br |
|||||
| Ransomware | headwaterco.com id16897 View details | United States | Other | ||
|
headwaterco.com |
|||||
| Ransomware | www.al-shefafarm.ro id16896 View details | Romania | Agriculture / Food | ||
|
www.al-shefafarm.ro |
|||||
| Ransomware | www.ykp.com.br id16895 View details | Brazil | Other | ||
|
www.ykp.com.br |
|||||
| Ransomware | www.go4kora.tv id16894 View details | Tuvalu | Other | ||
|
www.go4kora.tv |
|||||
| Ransomware | www.rekamy.com id16893 View details | Malaysia | Other | ||
|
www.rekamy.com |
|||||
| Ransomware | www.dvttechnologyltd.com id16892 View details | United States | IT | ||
|
www.dvttechnologyltd.com |
|||||
| Ransomware | www.siea.sk id16891 View details | Slovakia | Other | ||
|
www.siea.sk |
|||||
| Ransomware | www.spmundi.com.br id16890 View details | Brazil | Other | ||
|
www.spmundi.com.br |
|||||
| Ransomware | www.merchant.id id16889 View details | Indonesia | Other | ||
|
www.merchant.id |
|||||
| Ransomware | www.cyncsolutions.com id16888 View details | United States | Services | ||
|
www.cyncsolutions.com |
|||||
| Ransomware | Baca County Feedyard, Inc id16887 View details | United States | Public Sector | ||
|
Baca County Feedyard, Inc |
|||||
| Ransomware | www.skywaycoach.ca id16886 View details | Canada | Other | ||
|
www.skywaycoach.ca |
|||||
| Ransomware | www.farmaciaflorio.com id16885 View details | Italy | Agriculture / Food | ||
|
www.farmaciaflorio.com |
|||||
| Ransomware | www.nrshealthcare.com id16884 View details | United Kingdom | Healthcare / Pharma | ||
|
www.nrshealthcare.com |
|||||
| Ransomware | www.hcisystems.net id16883 View details | United States | Services | ||
|
www.hcisystems.net |
|||||
| Ransomware | www.betteraccountingsolutions.com id16882 View details | United States | Finance / Legal / Insurance | ||
|
www.betteraccountingsolutions.com |
|||||
| Ransomware | www.aretusamilano.it id16881 View details | Italy | Other | ||
|
www.aretusamilano.it |
|||||
| Ransomware | www.agenciahost.com id16880 View details | Brazil | Other | ||
|
www.agenciahost.com |
|||||
| Ransomware | www.constelacion.com.sv id16879 View details | El Salvador | Other | ||
|
www.constelacion.com.sv |
|||||
| Ransomware | www.avantit.no id16878 View details | Norway | Other | ||
|
www.avantit.no |
|||||
| Ransomware | www.industrialdealimentos.com id16877 View details | Colombia | Manufacturing / Engineering | ||
|
www.industrialdealimentos.com |
|||||
| Ransomware | www.lapastina.com id16876 View details | Brazil | Other | ||
|
www.lapastina.com |
|||||
| Ransomware | www.kovra.com.my id16875 View details | Malaysia | Other | ||
|
www.kovra.com.my |
|||||
| Ransomware | www.computan.com id16874 View details | Canada | Other | ||
|
www.computan.com |
|||||
| Ransomware | www.scadea.com id16873 View details | United States | Other | ||
|
www.scadea.com |
|||||