Ransomware Group intelligence

Babuk2

Inactive

Track Babuk2 with 195 published victims and 4 known leak locations in a single intelligence view.

Victims 195 Known published victims in this dataset
First discovered 2025-01-27 Earliest victim discovery date
Last discovered 2025-04-23 Latest victim discovery date
Inactive since 451 days Days since the latest known victim
Top country United States 35 victims
Known locations 4 Leak or negotiation infrastructure tracked

Overview

Babuk2 is tracked by Breach House as a ransomware group with 195 published victims.

United States is currently the most targeted country in this dataset.

4 known leak locations are currently associated with this group.

Top Countries

Interactive distribution based on the currently visible victims list.

Top Countries
Distribution

    Known Leak Locations (4)

    Label Type Availability Links
    Leak location 1 Onion service Unknown 7dikawx73goypgfi4zyo5fcajxwb7agemmiwqax3p54aey4dwobcvcyd.onion
    Leak location 2 Onion service Unknown bxwu33iefqfc3rxigynn3ghvq4gdw3gxgxna5m4aa3o4vscdeeqhiqad.onion
    Leak location 3 Web location Unknown 212.24.99.211.
    Leak location 4 Web location Unknown 5g2e.l.time4vps.cloud

    Top Activity Sectors

    No sector intelligence available.

    Research Sources

    No external research sources linked yet.

    Victims (195)

    Search, filter and paginate the victim timeline for Babuk2. Showing 101–195 of 195.

    Type Target Discovered Country Business Category Intel Link
    Ransomware parliament.iq id18396 View details Iraq Other
    Ransomware web.asia.edu.tw - Taiwan (Asia University) id21591 View details Taiwan, Province of China Education
    Ransomware web.asia.edu.tw - Taiwan (Asia University) id29979 View details Taiwan, Province of China Education
    Ransomware web.asia.edu.tw - Taiwan (Asia University) id29979 View details Taiwan, Province of China Education
    Ransomware Intelligence Bureau of the Joint Staff Department of the Central Military Commission China id18394 View details China Public Sector
    Ransomware Indian military and government defense 20TB id18393 View details Public Sector
    Ransomware Iraqi Ministry of Finance id18384 View details Iraq Finance / Legal / Insurance
    Ransomware Iraqi Council of Ministers id18383 View details Iraq Public Sector
    Ransomware marinabaysands.com -  Singapore Hotel (Internal Server) id18373 View details Singapore Hospitality / Food & Beverage / Tourism
    Ransomware hitekgroup.in india Finance id18368 View details India Finance / Legal / Insurance
    Ransomware India's telecommunication network id18362 View details India Telecommunications
    Ransomware Babuk Locker 2.0 affiliate program 2025 id18358 View details United Kingdom Communication / Marketing
    Ransomware Baykar Turkish defense company C4I and artificial intelligence id18349 View details Türkiye Services
    Ransomware wapda.gov.pk By Babuk Locker 2.0 id18316 View details Pakistan Other
    Ransomware airexplore.aero Company id18325 View details Slovakia Services
    Ransomware fnde.gov.br brazilian government id18317 View details Brazil Public Sector
    Ransomware wapda.gov.pk id18321 View details Pakistan Other
    Ransomware lexmark.com Company id18315 View details United States Services
    Ransomware forvismazars.com.fr ( mazars.fr ) By Babuk Locker 2.0 id18313 View details France Other
    Ransomware forvismazars.com.fr ( mazars.fr ) id18348 View details France Other
    Ransomware petstop.com Company id18311 View details United States Services
    Ransomware misaludhealth.com By Babuk Locker 2.0 id18310 View details United Kingdom Healthcare / Pharma
    Ransomware misaludhealth.com id18347 View details United States Healthcare / Pharma
    Ransomware bank.pingan.com (CN) By Babuk Locker 2.0 id18309 View details China Finance / Legal / Insurance
    Ransomware bank.pingan.com (CN) id18346 View details China Finance / Legal / Insurance
    Ransomware Access to Indian Ministry of Defence and Military Secret (DRDO) documents By Babuk Locker ... id18308 View details India Public Sector
    Ransomware Mandarin.com.br By Babuk Locker 2.0 id18305 View details Brazil Other
    Ransomware Mandarin.com.br id18345 View details Brazil Other
    Ransomware mazars.fr id18296 View details France Other
    Ransomware INDONESIA TAXPAYER IDENTIFICATION NUMBER (NPWP) id16958 View details Indonesia Other
    Ransomware MYINDIHOME TELKOM INDONESIA by ( Babuk Locker ) id16956 View details Indonesia Other
    Ransomware MYINDIHOME TELKOM INDONESIA id16951 View details Indonesia Other
    Ransomware MYPERTAMINA INDONESIA id16947 View details Indonesia Other
    Ransomware copral.com.br id16936 View details Brazil Communication / Marketing
    Ransomware human.de id16933 View details Germany Communication / Marketing
    Ransomware bocagroup.com id16932 View details United States Construction / Real Estate
    Ransomware alentec.com id16931 View details Sweden Telecommunications
    Ransomware Württemberger Medien id16930 View details Germany IT
    Ransomware viacaojacarei.com.br id16929 View details Brazil Other
    Ransomware gelco-s-a.com.br id16928 View details Brazil Other
    Ransomware Kurosu & Co.SA - kurosu.com.py id16927 View details Paraguay Other
    Ransomware zapopan.gob.mx id16926 View details Mexico Other
    Ransomware carc.gov.jo id16925 View details Jordan Other
    Ransomware nhbg.com.co id16924 View details Colombia Other
    Ransomware APMS ( Advanced Physician Management Service LLC id16923 View details United States Services
    Ransomware a top-tier law firm in Workers Compensation Defense! id16922 View details Finance / Legal / Insurance
    Ransomware precisediagnosticspacs.com id16921 View details United States Communication / Marketing
    Ransomware zetech.ac.ke id16920 View details Kenya IT
    Ransomware maxprofit.mcode.me id16919 View details Communication / Marketing
    Ransomware skopje.gov.mk id16918 View details North Macedonia Other
    Ransomware rtdc.gov.mn id16917 View details Mongolia Other
    Ransomware pbos.gov.pk id16916 View details Pakistan Other
    Ransomware abd-ong.org id16915 View details Spain Other
    Ransomware mtgazeta.uz id16914 View details Uzbekistan Other
    Ransomware sincorpe.org.br id16913 View details Brazil Services
    Ransomware pti.agency id16912 View details Germany Communication / Marketing
    Ransomware singularanalysts.com id16911 View details United States Other
    Ransomware gervetusa.com id16910 View details United States Other
    Ransomware workers.com.zm id16909 View details Zambia Other
    Ransomware wacer.com.au id16908 View details Australia Other
    Ransomware thebetareview.com id16907 View details United States Other
    Ransomware senseis.xmp.net id16906 View details Other
    Ransomware fpsc-anz.com id16905 View details Australia Other
    Ransomware mandiricoal.net id16904 View details India Other
    Ransomware dealplexus.com id16903 View details India Other
    Ransomware bee-insurance.com id16902 View details United States Finance / Legal / Insurance
    Ransomware lamundialdeseguros.com id16901 View details Colombia Other
    Ransomware indianaerospaceandengineering.com id16900 View details United States Manufacturing / Engineering
    Ransomware gstpam.org id16899 View details Other
    Ransomware www.shootinghouse.com.br id16898 View details Brazil Other
    Ransomware headwaterco.com id16897 View details United States Other
    Ransomware www.al-shefafarm.ro id16896 View details Romania Agriculture / Food
    Ransomware www.ykp.com.br id16895 View details Brazil Other
    Ransomware www.go4kora.tv id16894 View details Tuvalu Other
    Ransomware www.rekamy.com id16893 View details Malaysia Other
    Ransomware www.dvttechnologyltd.com id16892 View details United States IT
    Ransomware www.siea.sk id16891 View details Slovakia Other
    Ransomware www.spmundi.com.br id16890 View details Brazil Other
    Ransomware www.merchant.id id16889 View details Indonesia Other
    Ransomware www.cyncsolutions.com id16888 View details United States Services
    Ransomware Baca County Feedyard, Inc id16887 View details United States Public Sector
    Ransomware www.skywaycoach.ca id16886 View details Canada Other
    Ransomware www.farmaciaflorio.com id16885 View details Italy Agriculture / Food
    Ransomware www.nrshealthcare.com id16884 View details United Kingdom Healthcare / Pharma
    Ransomware www.hcisystems.net id16883 View details United States Services
    Ransomware www.betteraccountingsolutions.com id16882 View details United States Finance / Legal / Insurance
    Ransomware www.aretusamilano.it id16881 View details Italy Other
    Ransomware www.agenciahost.com id16880 View details Brazil Other
    Ransomware www.constelacion.com.sv id16879 View details El Salvador Other
    Ransomware www.avantit.no id16878 View details Norway Other
    Ransomware www.industrialdealimentos.com id16877 View details Colombia Manufacturing / Engineering
    Ransomware www.lapastina.com id16876 View details Brazil Other
    Ransomware www.kovra.com.my id16875 View details Malaysia Other
    Ransomware www.computan.com id16874 View details Canada Other
    Ransomware www.scadea.com id16873 View details United States Other