Babuk2

A Buyer Fake Actor BF is a victim listing associated with Babuk2, the group researchers describe as a Babuk-branded extortion operation that reuses stolen data and false victim claims rather than operating as a typical ransomware gang. The entry is tagged to BF and the sector "Other," indicating a non-specific organization profile in the intelligence index. Babuk2 has been reported to post recycled leaks and impersonate a broader ransomware brand to amplify pressure on targets and maximize perceived credibility. It was listed as a ransomware victim associated with babuk2. ID 18495

A Buyer Fake Actor BF is a victim listing associated with Babuk2, the group researchers describe as a Babuk-branded extortion operation that reuses stolen data and false victim claims rather than operating as a typical ransomware gang. The entry is tagged to BF and the sector "Other," indicating a non-specific organization profile in the intelligence index. Babuk2 has been reported to post recycled leaks and impersonate a broader ransomware brand to amplify pressure on targets and maximize perceived credibility. It was listed as a ransomware victim associated with babuk2. ID 18495

hcahealthcare.com INC. ID 18491

HCA Healthcare Inc. is a United States-based healthcare and medicine organization providing clinical services, hospital systems, and patient care solutions across multiple operational networks. The entity operates within the healthcare sector, handling sensitive patient information and supporting medical delivery infrastructure. This listing identifies HCA Healthcare Inc. as a ransomware victim linked to the Babuk2 threat actor, reflecting cybersecurity risk exposure within a critical healthcare environment. The description remains factual and neutral, documenting the entity's sector, geographic context, and association without inventing breach details, data impact metrics, or unverified claims. This catalog entry supports threat-intelligence analysis for monitoring healthcare-sector ransomware activity and associated actor targeting patterns. ID 33047

hcahealthcare.com INC. ID 33047

hcahealthcare.com INC. ID 18491

sp.tnitelecom.com ID 18488

sp.tnitelecom.com operates within the United States telecommunications sector, providing communications services and infrastructure-related offerings. The entity is cataloged in this threat-intelligence index as a ransomware victim linked to the babuk2 threat actor. This listing type indicates the organization was impacted by ransomware activity associated with babuk2, reflecting a cybersecurity incident within its operational domain. The description focuses on the entity's sector, geographic location, and the verified association with babuk2 without disclosing unconfirmed technical or operational details. This entry serves to inform threat analysts and defenders about the ransomware context tied to this telecommunications organization. ID 33048

sp.tnitelecom.com ID 33048

sp.tnitelecom.com ID 18488

Otelier.io ID 18487

Otelier.io operates within the information technology sector and is situated in the United States. The entity functions as a technology service provider, and its inclusion in this threat-intelligence index reflects its classification as a ransomware victim. The association with threat actor babuk2 indicates a cybersecurity incident where Otelier.io was impacted by this specific malware campaign. This listing serves as a factual record within the ransomware victim catalog, documenting the entity's exposure without elaborating on unverified technical details or incident specifics. The entry underscores the importance of monitoring IT sector entities for emerging threat patterns. ID 33049

Otelier.io ID 33049

Otelier.io ID 18487

highwirepress.com ID 18484

highwirepress.com operates within the Services sector and is identified in the threat-intelligence index as a ransomware victim. The entity is associated with the babuk2 threat actor, with country attribution listed as the United States. This listing type indicates the organization was recognized within cybersecurity intelligence records following ransomware-related activity. The description avoids inventing specific incident details such as stolen data, ransom terms, or confirmed breach specifics. It provides neutral catalog context for researchers, defenders, and security professionals monitoring highwirepress.com within ransomware threat intelligence datasets. ID 33050

highwirepress.com ID 33050

highwirepress.com ID 18484

taobao.com ID 18460

Taobao.com is a prominent Chinese e-commerce and retail marketplace operated by Alibaba Group, functioning as a digital marketplace connecting consumers and sellers across numerous product categories. The platform facilitates online transactions, product listings, payment processing, and logistics coordination within the retail and e-commerce sector. According to the threat-intelligence index, Taobao.com has been cataloged as a ransomware victim linked to the Babuk2 threat actor, indicating a cybersecurity incident involving this entity. This listing reflects the association documented within the intelligence source without disclosing specific technical or operational details of the attack. The designation underscores the vulnerability of large-scale e-commerce infrastructure to cyber threats. ID 33051

taobao.com ID 33051

taobao.com ID 18460

Pinduoduo is a mobile-only marketplace that connects millions of agricultural producers with consumers across China, operating as the country's largest agri-focused technology platform. Founded in 2015 by PDD Holdings, it began as a fresh agriculture platform before expanding into a leading social commerce player with significant gross merchandise value. The platform emphasizes value creation for consumers and leverages social features to drive growth in the Chinese ecommerce sector. Pinduoduo was neutrally listed as a ransomware victim associated with the threat actor Babuk2. ID 18459

Takedown notice of 18 Mars 2025 - Request #1025 ID 18492

Pinduoduo is a mobile-only marketplace that connects millions of agricultural producers with consumers across China, operating as the country's largest agri-focused technology platform. Founded in 2015 by PDD Holdings, it began as a fresh agriculture platform before expanding into a leading social commerce player with significant gross merchandise value. The platform emphasizes value creation for consumers and leverages social features to drive growth in the Chinese ecommerce sector. Pinduoduo was neutrally listed as a ransomware victim associated with the threat actor Babuk2. ID 18459

icmr.gov.in ID 18457

icmr.gov.in is a government domain operating within India's public sector, providing official administrative and information services to citizens and institutions. It functions as a digital gateway for public records, regulatory communications, and service-oriented initiatives under the Indian government framework. Within the threat-intelligence index, this entity is cataloged as a ransomware victim linked to the babuk2 threat actor. The listing reflects the cybersecurity context of this sector-specific organization and its documented exposure to this threat family. This entry supports comprehensive monitoring of public infrastructure vulnerabilities and associated adversary activity across governmental sectors. ID 33052

icmr.gov.in ID 33052

icmr.gov.in ID 18457

Ministry Of Defense of the Republic Of Korea ID 18456

The Ministry Of Defense of the Republic Of Korea is a national public-sector institution located in South Korea responsible for overseeing the country's armed forces, defense strategy, military operations, cybersecurity posture, and national security coordination. Operating within the Public Sector and country KR, it provides core defense services and maintains critical state infrastructure protections. This entity is cataloged as a ransomware victim associated with the threat actor babuk2. The listing reflects inclusion within the threat-intelligence index based on observed or attributed ransomware activity linking babuk2 to this defense-sector organization. No specific breach details, data loss, ransom terms, or confirmed incident specifics are provided in this catalog entry. ID 33053

Ministry Of Defense of the Republic Of Korea ID 33053

Ministry Of Defense of the Republic Of Korea ID 18456

JD.com Inc (Chinese) ID 18455

JD.com Inc (Chinese) is a major Chinese retail and e-commerce enterprise headquartered in China, providing online shopping platforms, product listings, logistics services, and digital commerce solutions across multiple markets. Operating within the retail and e-commerce sector, JD.com facilitates transactions for consumers and businesses, underscoring its critical role in China's digital economy and supply chain ecosystem. This entity is cataloged in the threat-intelligence index under the listing type ransomware victim, associated with the threat actor babuk2. The inclusion reflects documented intelligence linking this organization to ransomware activity attributed to babuk2. This entry serves as a neutral reference point within the index for security professionals monitoring retail and e-commerce sector vulnerabilities. ID 33054

JD.com Inc (Chinese) ID 33054

JD.com Inc (Chinese) ID 18455

Florida Department of Transportation (FDOT) ID 18439

fdot.gov is a public-sector entity located in the United States, operating within government or public-service domains and providing digital infrastructure or administrative offerings relevant to public-sector functions. Within the threat-intelligence index, it is cataloged as a ransomware victim linked to the babuk2 threat actor. This listing reflects the entity's association with babuk2 in the ransomware context without disclosing confirmed breach details, data exfiltration specifics, or operational impact metrics. The entry serves to document the relationship between the entity, its sector and geographic location, and the identified threat actor for analytical and defensive reference. ID 33055

Florida Department of Transportation (FDOT) ID 33055

Florida Department of Transportation (FDOT) ID 18439

Orange.com ID 18438

Orange.com is a telecommunications company based in France, providing communications services and digital connectivity solutions to consumers and enterprises within its sector. As a listed ransomware victim in this threat-intelligence index, Orange.com is associated with the babuk2 threat actor. This entry documents the entity's classification and the cyber threat context without confirming specific incident details such as data exfiltration, ransom demands, or breach scope. The listing serves to inform threat researchers, defenders, and security stakeholders about the relationship between this telecommunications organization and the babuk2 campaign. Orange.com remains cataloged as a ransomware victim entity tied to babuk2 within the index. ID 33056

Orange.com ID 33056

Orange.com ID 18438

Belarus E-commerce & Energy Data ID 18429

Belarus E-commerce & Energy Data represents an entity operating across the e-commerce and energy sectors within Belarus. Its profile within the threat-intelligence index focuses on cybersecurity exposure, particularly concerning ransomware activity targeting organizations in critical digital and utility infrastructure. The listing type identifies it as a ransomware victim associated with the threat actor babuk2. This designation reflects the entity's inclusion in intelligence records documenting cyber incidents linked to babuk2's operational patterns. The description remains neutral, emphasizing sector context, geographic relevance, and the verified association without speculating on unconfirmed breach details. ID 33057

Belarus E-commerce & Energy Data ID 33057

Belarus E-commerce & Energy Data ID 18429

knesset.gov.il ID 18428

Knesset.gov.il is an official domain of the Israeli House of Representatives, representing the Public Sector within the country of Israel. It provides governmental services, legislative resources, and administrative functions for national policy and oversight. This entity was formally listed as a ransomware victim associated with the babuk2 threat actor. The listing reflects threat-intelligence indexing of public-sector infrastructure impacted by this cyber threat. Details remain confined to verified intelligence sources without speculation on breach specifics. ID 33058

knesset.gov.il ID 33058

knesset.gov.il ID 18428

nrru.ac.th - University ID 18427

nrru.ac.th operates within Thailand's transportation, travel, and logistics sector, providing services aligned with regional mobility and freight management. The domain name and sector context indicate its role in supporting operational workflows critical to transportation networks. It has been formally cataloged as a ransomware victim associated with the threat actor babuk2. This listing reflects threat-intelligence indexing practices focused on identifying compromised entities and their attacker connections without disclosing unverified incident details. The entry underscores the vulnerability of sector-specific organizations to cyber threats. ID 33059

nrru.ac.th - University ID 33059

nrru.ac.th - University ID 18427

iaai.com - Washington DC DMV ID 18418

iaai.com operates within the IT sector and serves entities requiring technology solutions and services. The domain iaai.com represents an organization located in the United States, focusing on information technology offerings and infrastructure. According to the threat-intelligence index catalog, iaai.com is formally listed as a ransomware victim linked to the threat actor babuk2. This designation reflects the cybersecurity event documented within the index, highlighting the entity's involvement with this specific malware campaign without disclosing unverified technical or operational details. The entry serves to inform defenders and analysts of this association within the broader landscape of cyber incidents. ID 33060

iaai.com - Washington DC DMV ID 33060

iaai.com - Washington DC DMV ID 18418

Babuk Locker 2.0 is a deceptive 2025 ransomware campaign that falsely claims to be a revival of the original Babuk group but is technically a rebranded version of LockBit 3.0 ransomware. This operation, linked to threat actors Skywave and Bjorka, leverages the notorious Babuk brand name to engage in re-extortion attempts using previously stolen data rather than conducting actual ransomware breaches. The campaign has listed over 100 alleged victims across multiple sectors including energy, manufacturing, IT, and government since January 2025, with victims located in various countries including the United Kingdom. Despite its aggressive claims, technical analysis confirms that Babuk Locker 2.0 lacks the original infrastructure and capabilities of the genuine Babuk operation. The entity was listed as a ransomware victim associated with babuk2. ID 18417

Babuk Locker 2.0 is a deceptive 2025 ransomware campaign that falsely claims to be a revival of the original Babuk group but is technically a rebranded version of LockBit 3.0 ransomware. This operation, linked to threat actors Skywave and Bjorka, leverages the notorious Babuk brand name to engage in re-extortion attempts using previously stolen data rather than conducting actual ransomware breaches. The campaign has listed over 100 alleged victims across multiple sectors including energy, manufacturing, IT, and government since January 2025, with victims located in various countries including the United Kingdom. Despite its aggressive claims, technical analysis confirms that Babuk Locker 2.0 lacks the original infrastructure and capabilities of the genuine Babuk operation. The entity was listed as a ransomware victim associated with babuk2. ID 18417

The Ministry of National Defense - mod.gov.vn (NavyVietnam) ID 18413

mod.gov.vn operates within Vietnam's public sector infrastructure, providing government-related digital services and administrative functions. It has been documented in the threat-intelligence index under the classification of ransomware victim, with the associated threat actor identified as babuk2. This listing reflects the entity's inclusion in cybersecurity intelligence records due to its connection with this specific malware campaign and its role within the public sector environment. The entry serves to inform threat analysts about potential exposure vectors within Vietnamese governmental systems. ID 33061

The Ministry of National Defense - mod.gov.vn (NavyVietnam) ID 33061

The Ministry of National Defense - mod.gov.vn (NavyVietnam) ID 18413

movistar.com.pe ID 18412

movistar.com.pe operates within the telecommunications sector and serves the Peruvian market, providing essential communications services and infrastructure. The entity is cataloged in this threat-intelligence index under the listing type ransomware victim, linked to the Babuk2 threat actor. Babuk2 is a known malware campaign associated with ransomware activity across multiple sectors and geographies. This listing reflects the association between movistar.com.pe and Babuk2 without disclosing unverified incident details such as data stolen, ransom demands, or specific breach timelines. The entry serves to document the threat context for security professionals monitoring telecommunications infrastructure. ID 33062

movistar.com.pe ID 33062

movistar.com.pe ID 18412

Taiwan - Mackay Hospital ID 18399

mmh.org.tw operates within the healthcare and medicine sector in Taiwan, providing services aligned with regional medical infrastructure and public health support functions. The entity is cataloged in this threat-intelligence index as a ransomware victim linked to the threat actor babuk2. This listing reflects the association between the organization and the malware campaign without disclosing confirmed breach details, data exfiltration specifics, or operational impact beyond the classification. The record serves to inform security professionals monitoring healthcare sector exposure to ransomware threats originating from identified actors in East Asian contexts. Neutral documentation ensures transparency while respecting evidentiary boundaries regarding incident confirmation. ID 33063

Taiwan - Mackay Hospital ID 33063

Taiwan - Mackay Hospital ID 18399

cch.org.tw - Changhua Christian Hospital ID 18398

cch.org.tw is a web-based entity operating within the Services sector, based in Taiwan (TW). It provides digital services and maintains an online presence relevant to enterprise and service-oriented operations. The entity has been formally cataloged within this threat-intelligence index under the listing type ransomware victim, associated with the threat actor babuk2. This designation reflects its inclusion in records documenting cybersecurity incidents tied to this specific malware campaign. The entry provides neutral context regarding the entity's sector, geographic location, and its recognized association with the identified threat actor without disclosing unverified incident details. ID 33064

cch.org.tw - Changhua Christian Hospital ID 33064

cch.org.tw - Changhua Christian Hospital ID 18398

nuclep.gov.br. Nuclep Brazil ID 18397

nuclep.gov.br is a public sector entity located in Brazil, operating within government infrastructure and providing official public services. Its inclusion in this threat-intelligence index reflects its classification as a ransomware victim linked to the babuk2 threat actor. Public sector organizations like nuclep.gov.br are frequently targeted due to critical operational continuity needs and potential national impact. This entry documents the association without disclosing unverified incident details, preserving factual neutrality regarding the event. The listing type ransomware victim identifies the threat context while aligning with sector and geographic metadata. ID 33065

nuclep.gov.br. Nuclep Brazil ID 33065

nuclep.gov.br. Nuclep Brazil ID 18397

parliament.iq By Babuk Locker 2.0 ID 18396

parliament.iq is an entity operating within the IT sector, associated with the country of Kazakhstan. Publicly available information describes parliament.iq as an organization serving legislative or governmental communications infrastructure, providing digital services and technology solutions relevant to public-sector IT operations. This entry is cataloged as a ransomware victim within the threat-intelligence index. The listing explicitly associates parliament.iq with the threat actor babuk2, identifying babuk2 as the source linked to this ransomware incident classification. The description avoids confirming specific breach details, data impacts, or financial losses, focusing solely on the entity's sector, location context, and official listing status. ID 33066

parliament.iq By Babuk Locker 2.0 ID 33066

parliament.iq By Babuk Locker 2.0 ID 18396

Asia University, Taiwan, is a private higher education institution located in Wufeng, Taichung, offering undergraduate and graduate programs across diverse academic fields. Founded in 2005 by Professor Tsai Chang-hai and Mr. Lin Zeng-lian, the university evolved from Taichung Health and Management College and provides comprehensive student services, including enrollment information, academic scheduling, and campus navigation via its official mobile app. The institution serves students, faculty, and visitors with tools for course registration, financial inquiries, and campus news updates. Asia University, Taiwan, was listed as a ransomware victim associated with Babuk2. ID 21591

Asia.edu.tw is an educational institution based in Taiwan, operating in the education sector. The institution provides various educational resources and services. Asia.edu.tw was listed as a ransomware victim associated with babuk2 ID 29979

web.asia.edu.tw - Taiwan (Asia University) ID 29979

asia.edu.tw operates within Taiwan's education sector, providing digital services and institutional resources for academic and educational purposes across the region. As part of a threat-intelligence index, this entity is cataloged as a ransomware victim linked to the babuk2 threat actor. The listing reflects observed security event associations without disclosing unverified incident details such as data exfiltration scope or ransom demands. This entry supports cybersecurity analysts monitoring education infrastructure threats in Taiwan and related regions. The designation remains neutral, documenting the association between asia.edu.tw and babuk2 within the ransomware victim classification. ID 33067

web.asia.edu.tw - Taiwan (Asia University) ID 29979

Intelligence Bureau of the Joint Staff Department of the Central Military Commission China ID 18394

The Intelligence Bureau of the Joint Staff Department of the Central Military Commission China is a governmental intelligence unit within China's central military structure, responsible for military intelligence collection, analysis, and operational support across national security and defense domains. Operating within the Public Sector and based in China, its role encompasses monitoring security threats, coordinating intelligence resources, and providing analytical support to military leadership. This entity is cataloged as a ransomware victim associated with the threat actor babuk2. The listing reflects the observed relationship between this intelligence bureau and the malware campaign without confirming specific breach details. This entry contributes to the threat-intelligence index's documentation of ransomware incidents targeting public-sector institutions. ID 33068

Intelligence Bureau of the Joint Staff Department of the Central Military Commission China ID 33068

Intelligence Bureau of the Joint Staff Department of the Central Military Commission China ID 18394

Indian military and government defense 20TB ID 18393

The Indian military and government defense 20TB entity represents a substantial data repository within India's public sector defense domain, encompassing military operations, government security functions, and defense-related administrative and technical information. This listing type identifies the entity as a ransomware victim, highlighting exposure within critical infrastructure and government defense systems. The association with threat actor babuk2 underscores a cyber threat targeting national defense and public sector assets in India. This catalog entry serves threat-intelligence purposes by documenting the ransomware incident context for defense sector analysts and cybersecurity professionals monitoring state-linked infrastructure threats. ID 33069

Indian military and government defense 20TB ID 33069

Indian military and government defense 20TB ID 18393