Babuk2

tecnologias.mspz2.gob.ec ID 19320

turkish defense military ID 18945

rheinmetall.com (Rheinmetall Defence) ID 18944

gangotreehomes.com (RealEstate) ID 18941

Secret plans of Indian army ID 18940

Bangladesh Armed Forces (BangLadesh Army) ID 18939

Saudi Arabian military and government internal center ID 18938

Hellenic Airforce ID 18937

ezbuy.sg (Singapore Shopping) ID 18934

Iran gas service system, ID 18933

kfar hatta medical center - Lebanon ID 18932

Polizia italia mail access ID 18930

zalora.sg (Singapore Shopping) ID 18929

ascires.com ID 18920

aosense.com - AO Sense INC. ID 18919

dardoc.com ID 18918

navy-mil-bd ID 18916

drdo.gov.in ID 18901

uniproof.com.br ID 18900

(UPDATE) - whitecapcanada.com ID 18897

pln.co.id - PLN INDONESIA ID 18861

moh.gov.rw ID 18860

iDRAC (Integrated Dell Remote Access Controller) management interface for Dell servers ID 18795

elsoms.com ID 18782

brune.com.br - Group MC (conglomerate) ID 18781

towellengineering.net ID 18780

icvc.co - Instituto Cardiovascular del Cesar ID 18779

modiin-ezrachi.co.il ID 18778

La Futura ID 18777

Atlantic Coast Consulting Inc ID 18776

theeyeclinicsurgicenter.com - The Eye Clinic Surgicenter company ID 18775

🚀 Launch Your Own Ransomware(RAAS) Business with Our Exclusive Ransomware Panel Source Cod... is a Services-sector entity named in threat-intelligence listings as a ransomware victim. The title suggests a RaaS-themed offering or storefront, but the available source material does not provide confirmed public details about its location, products, or operating footprint. In ransomware-as-a-service ecosystems, operators typically provide malware, infrastructure, and affiliate tooling to customers or partners, but no source here verifies that this entity actually operated such a platform. It was listed as a ransomware victim associated with babuk2. ID 18773

leadzen.ai ID 18764

healthcasts.com ID 18763

pureincubation.com ID 18762

unired.uz ID 18759

nadra.gov.pk - NADRA official Of Pakistan Army & (Andhra Pradesh) ID 18739

nadra.gov.pk is the official website of Pakistan’s National Database and Registration Authority (NADRA), an autonomous government body under the Interior Secretary of Pakistan. NADRA manages national registration databases and provides identity and citizen-registration services, including Computerised National Identity Cards, through its public-facing online and service channels. Based in Islamabad, it serves a nationwide public-sector role within Pakistan’s government administration. The listing identified nadra.gov.pk as a ransomware victim associated with babuk2. ID 18738

heras.co.uk ID 18736

alliedwoundcare.com ID 18735

crimsgroup.com ID 18734

aman-iraq.com ID 18733

mot.gov.iq - Iraqi Ministry of Commerce (Of Trade) ID 18723

israel Infrastructure & Secret Documents intelligence information ID 18722

kalesavunma.com - KALE SAVUNMA. ID 18708

airexplore.aero ID 18667

iberdrola.com (Spain energy) ID 18662

Synesis Surveillance System ID 18604

inmarsat.com ID 18603

jp-property.com ID 18602

armetal.com ID 18598

DB Market – Buy & Sell Databases Safely! is presented as a US-based retail and e-commerce entity, and its name suggests a business focused on the buying and selling of databases. In threat-intelligence context, Babuk2 has been documented by multiple analysts as a branding operation that recycles victim names and leak pages rather than a proven original Babuk ransomware revival. Public reporting describes Babuk2 as using copied victim entries and false extortion claims to create the appearance of active ransomware activity. DB Market – Buy & Sell Databases Safely! was listed as a ransomware victim associated with babuk2. ID 18571

The Ticktin Law Group By Babuk Locker 2.0 ID 18570

Mpaj.gov.my ID 18569

exostar.com TOP Defense AS ID 18568

Our Official telegram channel babuk Locker 2.0 is a Telegram-based entity located in Great Britain operating within the Other sector. It functions as a platform associated with the Babuk Locker 2.0 ransomware group, which targets victims globally through Telegram channels. The channel is linked to threat actor babuk2, who has published it as a new victim in the ransomware ecosystem. Babuk Locker 2.0 is widely recognized by researchers as a deceptive operation using rebranded LockBit 3.0 code rather than a genuine return of the original group. It was listed as a ransomware victim associated with babuk2. ID 18567

Standard Capital Securities (Pvt) Backoffice - Pakistan Stock Market Data Vault ID 18566

mohrss.gov.cn ( Ministry of Human Resources and Social Security ) ID 18564

amazon.com ID 18563

fr.sodexo.com ID 18542

Corporate access, up to Shipping Apps in QATAR ID 18541

woqod.com ID 18540

mof.go.th - Ministry of Finance (Thailand) ID 18539

smic.mi.th (Thailand Intelligence Agency) ID 18534

www.gob.ve ID 18532

Access Panel Financial Technology Company (Thailand) ID 18531

United States County Palm Beach Goverment ID 18530

Municipal taxation Secretariat Access - Brazil Goverment ID 18529

Intelligence Bureau of the Joint Staff Department of the Central Military Commission China ID 18528

rac.gov.my ID 18527

nimapinfotech.com ID 18526

esaote.com ID 18503

nstda.or.th ID 18502

kominfo.go.id ID 18501

pajak.go.id ID 18500

dukcapil.kemendagri.go.id (SIAK DUKCAPIL MINISTRY OF HOME AFFAIRS OF INDONESIA) ID 18499

whitecapcanada.com ID 18496

A Buyer Fake Actor BF is a victim listing associated with Babuk2, the group researchers describe as a Babuk-branded extortion operation that reuses stolen data and false victim claims rather than operating as a typical ransomware gang. The entry is tagged to BF and the sector "Other," indicating a non-specific organization profile in the intelligence index. Babuk2 has been reported to post recycled leaks and impersonate a broader ransomware brand to amplify pressure on targets and maximize perceived credibility. It was listed as a ransomware victim associated with babuk2. ID 18495

hcahealthcare.com INC. ID 18491

sp.tnitelecom.com ID 18488

Otelier.io ID 18487

highwirepress.com ID 18484

taobao.com ID 18460

Pinduoduo is a mobile-only marketplace that connects millions of agricultural producers with consumers across China, operating as the country's largest agri-focused technology platform. Founded in 2015 by PDD Holdings, it began as a fresh agriculture platform before expanding into a leading social commerce player with significant gross merchandise value. The platform emphasizes value creation for consumers and leverages social features to drive growth in the Chinese ecommerce sector. Pinduoduo was neutrally listed as a ransomware victim associated with the threat actor Babuk2. ID 18459

Takedown notice of 18 Mars 2025 - Request #1025 ID 18492

icmr.gov.in ID 18457

Ministry Of Defense of the Republic Of Korea ID 18456

JD.com Inc (Chinese) ID 18455

Florida Department of Transportation (FDOT) ID 18439

Orange.com ID 18438

Belarus E-commerce & Energy Data ID 18429

knesset.gov.il ID 18428

nrru.ac.th - University ID 18427

iaai.com - Washington DC DMV ID 18418

Babuk Locker 2.0 is a deceptive 2025 ransomware campaign that falsely claims to be a revival of the original Babuk group but is technically a rebranded version of LockBit 3.0 ransomware. This operation, linked to threat actors Skywave and Bjorka, leverages the notorious Babuk brand name to engage in re-extortion attempts using previously stolen data rather than conducting actual ransomware breaches. The campaign has listed over 100 alleged victims across multiple sectors including energy, manufacturing, IT, and government since January 2025, with victims located in various countries including the United Kingdom. Despite its aggressive claims, technical analysis confirms that Babuk Locker 2.0 lacks the original infrastructure and capabilities of the genuine Babuk operation. The entity was listed as a ransomware victim associated with babuk2. ID 18417

The Ministry of National Defense - mod.gov.vn (NavyVietnam) ID 18413

movistar.com.pe ID 18412

Taiwan - Mackay Hospital ID 18399

cch.org.tw - Changhua Christian Hospital ID 18398

nuclep.gov.br. Nuclep Brazil ID 18397

parliament.iq By Babuk Locker 2.0 ID 18396

Asia University, Taiwan, is a private higher education institution located in Wufeng, Taichung, offering undergraduate and graduate programs across diverse academic fields. Founded in 2005 by Professor Tsai Chang-hai and Mr. Lin Zeng-lian, the university evolved from Taichung Health and Management College and provides comprehensive student services, including enrollment information, academic scheduling, and campus navigation via its official mobile app. The institution serves students, faculty, and visitors with tools for course registration, financial inquiries, and campus news updates. Asia University, Taiwan, was listed as a ransomware victim associated with Babuk2. ID 21591

Asia.edu.tw is an educational institution based in Taiwan, operating in the education sector. The institution provides various educational resources and services. Asia.edu.tw was listed as a ransomware victim associated with babuk2 ID 29979

web.asia.edu.tw - Taiwan (Asia University) ID 29979

Intelligence Bureau of the Joint Staff Department of the Central Military Commission China ID 18394

Indian military and government defense 20TB ID 18393

Iraqi Ministry of Finance ID 18384

Iraqi Council of Ministers ID 18383

marinabaysands.com -  Singapore Hotel (Internal Server) ID 18373

hitekgroup.in india Finance ID 18368

India's telecommunication network ID 18362

Babuk Locker 2.0 affiliate program 2025 refers to a 2025 ransomware brand and affiliate-style extortion operation that security researchers describe as a reworked campaign rather than a true Babuk revival. Reporting says it used Telegram channels to recruit affiliates, promote double-extortion services, and publicize alleged victim listings across multiple sectors. The entity is associated with the GB communication and marketing sector in victim-tracking context, reflecting how the listing is cataloged rather than a confirmed public company disclosure. It was listed as a ransomware victim associated with babuk2. ID 18358

Baykar Turkish defense company C4I and artificial intelligence By Babuk Locker 2.0 ID 18349

wapda.gov.pk is the official website of the Water and Power Development Authority (WAPDA), a Pakistani government-owned public utility agency based in Lahore, Punjab. WAPDA’s mandate covers the development and management of water and hydropower resources in Pakistan. Its online presence supports the authority’s public information, operational, and organizational functions. The entity was listed as a ransomware victim associated with babuk2. ID 18316

airexplore.aero Company ID 18325

fnde.gov.br brazilian government ID 18317

wapda.gov.pk By Babuk Locker 2.0 ID 18321

lexmark.com Company ID 18315

forvismazars.com.fr is the French website of Forvis Mazars, an international partnership headquartered in France. The firm provides audit, accounting, tax, and advisory services to businesses and other organizations, and operates from Levallois-Perret in the Paris area. Forvis Mazars describes itself as an integrated partnership active in more than 100 countries and territories, with a broad professional-services offering. In threat-intelligence indexing, it was listed as a ransomware victim associated with babuk2. ID 18313

forvismazars.com.fr ( mazars.fr ) By Babuk Locker 2.0 ID 18348

petstop.com Company ID 18311

misaludhealth.com is the digital platform for MiSalud Health, a San Francisco-based bilingual telehealth provider serving the Latinx community in the United States. The company offers Spanish-first virtual care, including on-demand consultations, same-day appointments, and behavioral health services through employers. Its offerings curate culturally appropriate healthcare services, providing access to U.S. licensed physicians and health coaches via video, phone, and messaging. The platform recently announced a GLP-1 support program to expand inclusive care access. misaludhealth.com was listed as a ransomware victim associated with the threat actor babuk2. ID 18310

misaludhealth.com By Babuk Locker 2.0 ID 18347

bank.pingan.com is the official website of Ping An Bank Co., Ltd., a Chinese joint-stock commercial bank headquartered in Shenzhen, China. It serves retail and corporate customers with diversified banking services, including online banking, enterprise banking, supply chain finance, and integrated onshore and offshore financial services. The bank operates through a broad branch and outlet network across China and maintains English-language access for digital banking and corporate business information. It was listed as a ransomware victim associated with babuk2. ID 18309

bank.pingan.com ID 18346

Access to Indian Ministry of Defence and Military Secret (DRDO) documents By Babuk Locker 2.0 ID 18308

Agência Mandarin is a shopper marketing and health marketing agency based in São Paulo, Brazil, specializing in sales conversion through proprietary methodologies. The agency transforms storefront facades into e-commerce access links via revitalization projects, serving clients in retail and health sectors. Founded in 2004 with 11 to 50 employees, it operates from Rua Luís Correia de Melo 92 in São Paulo. The agency was listed as a ransomware victim associated with the threat actor babuk2. ID 18305

Mandarin.com.br ID 18345

mazars.fr company ID 18296

INDONESIA TAXPAYER IDENTIFICATION NUMBER (NPWP) ID 16958

MYINDIHOME TELKOM INDONESIA ID 16956

MYINDIHOME TELKOM INDONESIA ID 16951

MYPERTAMINA INDONESIA ID 16947

Greetings! copral.com.br Today we are posting here the new company, "Copral Comercio e Navegacao LTDA". ID 16936

HUMAN, founded in 1972, is a Germany based privately owned company which develops, manufactures and distributes a wide range of IVD Diagnostics and laboratory equipment. ID 16933

As America's premier elevator and escalator consulting company, BOCA Group is the partner of choice for the biggest and best-known building owners and developer ID 16932

This is a public request for Alentec & Orion AB, you don't have much time left to get in touch with us and help you resolve your security problems, we also continue to be in your networks and monitor you ID 16931

Lassen Sie sich kostenlos von unseren Experten aus Stuttgart beraten. Digitalisierung geht schnell und einfach - Wir haben Lösungen für den Mittelstand! ID 16930

viacaojacarei.com.br ID 16929

gelco-s-a.com.br ID 16928

Kurosu & Co.SA - kurosu.com.py LEAKED ID 16927

zapopan.gob ID 16926

carc.gov ID 16925

nhbg ID 16924

APMS ( Advanced Physician Management Service LLC ID 16923

a top-tier law firm in Workers Compensation Defense! ID 16922

precisediagnosticspacs.com ID 16921

zetech.ac.ke ID 16920

maxprofit.mcode.me ID 16919

skopje.gov.mk ID 16918

rtdc.gov.mn access ID 16917

pbos.gov.pk ID 16916

abd-ong.org ID 16915

mtgazeta.uz ID 16914

sincorpe.org.br ID 16913

pti.agency ID 16912

singularanalysts.com ID 16911

gervetusa.com ID 16910

workers.com.zm ID 16909

wacer.com.au ID 16908

thebetareview.com ID 16907

senseis.xmp.net ID 16906

fpsc-anz.com ID 16905

mandiricoal.net ID 16904

dealplexus.com ID 16903

bee-insurance.com ID 16902

lamundialdeseguros.com ID 16901

indianaerospaceandengineering.com ID 16900

gstpam.org ID 16899

www.shootinghouse.com.br ID 16898

headwaterco.com ID 16897

www.al-shefafarm.ro ID 16896

www.ykp.com.br ID 16895

www.go4kora.tv ID 16894

www.rekamy.com ID 16893

www.dvttechnologyltd.com ID 16892

www.siea.sk ID 16891

www.spmundi.com.br ID 16890

www.merchant.id ID 16889

www.cyncsolutions.com ID 16888

Baca County Feedyard, Inc ID 16887

www.skywaycoach.ca ID 16886

www.farmaciaflorio.com ID 16885

www.nrshealthcare.com ID 16884

www.hcisystems.net ID 16883

www.betteraccountingsolutions.com ID 16882

www.aretusamilano.it ID 16881

www.agenciahost.com ID 16880

www.constelacion.com.sv ID 16879

www.avantit.no ID 16878

www.industrialdealimentos.com ID 16877

www.lapastina.com ID 16876

www.kovra.com.my ID 16875

www.computan.com ID 16874

www.scadea.com ID 16873