access and various companies By babuk Locker 2.0
babuk2This record tracks a ransomware attack claimed by the babuk2 group against access and various companies By babuk Locker 2.0. It collects the publicly disclosed attack details — sector, location and timeline — as published on the operator's leak site and indexed by Breach House.
Window Zero
EXPOSURE GAPWindow Zero is the time the breach stayed in the open before anyone said so — the gap between when the attack was first discovered on the operator's leak site (t1) and when it was publicly disclosed (t2). The wider this window, the longer victims, staff and customers were exposed with no warning.
Attack Summary
Babuk Locker 2.0 is a deceptive 2025 ransomware campaign that falsely claims to be a revival of the original Babuk group but is technically a rebranded version of LockBit 3.0 ransomware. This operation, linked to threat actors Skywave and Bjorka, leverages the notorious Babuk brand name to engage in re-extortion attempts using previously stolen data rather than conducting actual ransomware breaches. The campaign has listed over 100 alleged victims across multiple sectors including energy, manufacturing, IT, and government since January 2025, with victims located in various countries including the United Kingdom. Despite its aggressive claims, technical analysis confirms that Babuk Locker 2.0 lacks the original infrastructure and capabilities of the genuine Babuk operation. The entity was listed as a ransomware victim associated with babuk2.
Leak Screenshots
SAMPLEProof-of-breach screenshots the operator posted from the stolen data. Previews are redacted and locked — the originals are available on HaveIBeenRansom.