BabukMalware
Babuk is a Ransomware-as-a-service (RaaS) malware that has been used since at least 2021. The operators of Babuk employ a "Big Game Hunting" approach to targeting major enterprises and operate a leak site to post stolen data as part of their extortion scheme.From MITRE ATT&CK
Last reported 1 month ago, by Kaspersky Securelist8 reports
ATT&CK techniques
6 of 85 · each with the sentence it comes from- T1053.005Scheduled Task
“T1053.005”
- T1003OS Credential Dumping
“T1003”
- T1021.001Remote Desktop Protocol
“T1021.001”
- T1036Masquerading
“For instance, Halcyon reported increased instances of the LLM-developed EvilAI masquerading as fake AI-productivity apps while secretly providing ransomware actors initial access.”
- T1059Command and Scripting Interpreter
“Command and Scripting Interpreter: PowerShell”
- T1059.001PowerShell
“T1059.001”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
8 reports, newest first · the exact sentence from each-
Angry Birds: Toy Ghouls’ new toys“The attackers initially relied exclusively on tools pulled from public GitHub repositories along with leaked Babuk and LockBit ransomware builders, later shifting to their own custom ransomware, GenieLocker.”
-
Ransomware Groups Increasingly Deploy EDR Kill Techniques“…somware Research Center shared that The Gentlemen’s developers are systematically reverse-engineering samples from other groups, such as Babuk, Qilin, LockBit 5.0 and Medusa, to select the strongest encryption routines, code-obfuscation techniques and EDR evasion methods to incor…”
-
Interlock Ransomware: Evolving Under the Radar with ClickFix“Indeed, ransomware such as Clop, RansomHub, Akira, Babuk, Lynx, Qilin, and Fog, each claimed more than one hundred victims in the first quarter of 2025.”
-
How Hastalamuerte Operates: Group-IB’s Analysis of The Gentlemen’s Attack Methods“Ongoing reverse-engineering of Babuk, Qilin, LockBit 5.0, and Medusa ransomware samples to extract and integrate superior encryption routines, obfuscation techniques, and EDR bypass mechanisms into The Gentlemen codebase.”
-
Inside the Dragon: DragonForce Ransomware Group“Conti, Babuk, LockBit are among the common families that have been modified.”
-
Deciphering the Brain Cipher Ransomware“Also, the group published a Linux decryptor for an Indonesian victim, which turned out to be a variant of Babuk ransomware sample.”
-
Eldorado Ransomware: The New Golden Empire of Cybercrime?“Similarly, the Babuk ransomware source code was leaked on September 1, 2021, leading to the creation of multiple ransomware strains by different groups to exploit and exfiltrate data from targeted networks.”
-
The old way: BabLock, new ransomware quietly cruising around Europe, Middle East, and Asia“… Group-IB researchers in January 2023, was codenamed BabLock, because its versions for Linux and ESXi share similarities with the leaked Babuk ransomware.”
Indicators in its reports
named in the reports above- laboo[.]booin 1 report
- hxxp://ip-api[.]com/jsonin 1 report
- broker.hivemq[.]comin 1 report
- meet.element[.]twin 1 report
- bfadbeee63a4f0bf19ec9deb8fa58f58in 1 report
- 7916c33688385525078bee504c90f359in 1 report
Copy these 6 indicators · defanged
Thanks — we review every report.