Ransomware Group intelligence

Babuk2

Inactive

Track Babuk2 with 741 published victims and 4 known leak locations in a single intelligence view.

DARK EYE ALERTS
Want an alert every time a new ransomware post is published?
Choose the feeds and the countries you care about — we email you when they move.
Victims 741 Known published victims in this dataset
First discovered 2025-01-27 Earliest victim discovery date
Last discovered 2025-04-23 Latest victim discovery date
Inactive since 510 days Days since the latest known victim
Top country United States 139 victims
Known locations 4 Leak or negotiation infrastructure tracked

Overview

Babuk2 is tracked by Dark Eye as a ransomware group with 741 published victims.

United States is currently the most targeted country in this dataset.

4 known leak locations are currently associated with this group.

Leak Status Distribution

No leak-status data available yet.

Top Countries

Interactive distribution based on the currently visible victims list.

Top Countries
Distribution

    Known Leak Locations (4)

    Label Type Availability Links
    Leak location 3 Web location Down checked 2h ago 212.24.99.211.
    Leak location 4 Web location Down checked 2h ago 5g2e.l.time4vps.cloud
    Leak location 2 Onion service Down checked 2h ago bxwu33iefqfc3rxigynn3ghvq4gdw3gxgxna5m4aa3o4vscdeeqhiqad.onion
    Leak location 1 Onion service Down checked 2h ago 7dikawx73goypgfi4zyo5fcajxwb7agemmiwqax3p54aey4dwobcvcyd.onion

    Top Activity Sectors (17)

    Victims (741)

    Search, filter and paginate the victim timeline for Babuk2. Showing 601–700 of 741.

    Type Target Discovered Country Business Category Intel Link Leak status
    Ransomware wacer.com.au id16908 View details Australia Other
    Ransomware wacer.com.au id33123 View details Australia Other
    Ransomware wacer.com.au id33123 View details Australia Other
    Ransomware wacer.com.au id16908 View details Australia Other
    Ransomware thebetareview.com id16907 View details United States Other
    Ransomware thebetareview.com id33124 View details United States Other
    Ransomware thebetareview.com id33124 View details United States Other
    Ransomware thebetareview.com id16907 View details United States Other
    Ransomware senseis.xmp.net id16906 View details Other
    Ransomware senseis.xmp.net id33125 View details Other
    Ransomware senseis.xmp.net id33125 View details Other
    Ransomware senseis.xmp.net id16906 View details Other
    Ransomware fpsc-anz.com id16905 View details Australia Other
    Ransomware fpsc-anz.com id33126 View details Australia Other
    Ransomware fpsc-anz.com id33126 View details Australia Other
    Ransomware fpsc-anz.com id16905 View details Australia Other
    Ransomware mandiricoal.net id16904 View details India Other
    Ransomware mandiricoal.net id33127 View details India Other
    Ransomware mandiricoal.net id33127 View details India Other
    Ransomware mandiricoal.net id16904 View details India Other
    Ransomware dealplexus.com id16903 View details India Other
    Ransomware dealplexus.com id33128 View details India Other
    Ransomware dealplexus.com id33128 View details India Other
    Ransomware dealplexus.com id16903 View details India Other
    Ransomware bee-insurance.com id16902 View details United States Finance / Legal / Insurance
    Ransomware bee-insurance.com id33129 View details United States Finance / Legal / Insurance
    Ransomware bee-insurance.com id33129 View details United States Finance / Legal / Insurance
    Ransomware bee-insurance.com id16902 View details United States Finance / Legal / Insurance
    Ransomware lamundialdeseguros.com id16901 View details Colombia Other
    Ransomware lamundialdeseguros.com id33130 View details Colombia Other
    Ransomware lamundialdeseguros.com id33130 View details Colombia Other
    Ransomware lamundialdeseguros.com id16901 View details Colombia Other
    Ransomware indianaerospaceandengineering.com id16900 View details United States Manufacturing / Engineering
    Ransomware indianaerospaceandengineering.com id33131 View details United States Manufacturing / Engineering
    Ransomware indianaerospaceandengineering.com id33131 View details United States Manufacturing / Engineering
    Ransomware indianaerospaceandengineering.com id16900 View details United States Manufacturing / Engineering
    Ransomware gstpam.org id16899 View details Other
    Ransomware gstpam.org id33132 View details India Other
    Ransomware gstpam.org id33132 View details India Other
    Ransomware gstpam.org id16899 View details Other
    Ransomware www.shootinghouse.com.br id16898 View details Brazil Other
    Ransomware www.shootinghouse.com.br id33133 View details Brazil Other
    Ransomware www.shootinghouse.com.br id33133 View details Brazil Other
    Ransomware www.shootinghouse.com.br id16898 View details Brazil Other
    Ransomware headwaterco.com id16897 View details United States Other
    Ransomware headwaterco.com id33134 View details United States Other
    Ransomware headwaterco.com id33134 View details United States Other
    Ransomware headwaterco.com id16897 View details United States Other
    Ransomware www.al-shefafarm.ro id16896 View details Romania Agriculture / Food
    Ransomware www.al-shefafarm.ro id33135 View details Romania Agriculture / Food
    Ransomware www.al-shefafarm.ro id33135 View details Romania Agriculture / Food
    Ransomware www.al-shefafarm.ro id16896 View details Romania Agriculture / Food
    Ransomware www.ykp.com.br id16895 View details Brazil Other
    Ransomware www.ykp.com.br id33136 View details Brazil Other
    Ransomware www.ykp.com.br id33136 View details Brazil Other
    Ransomware www.ykp.com.br id16895 View details Brazil Other
    Ransomware www.go4kora.tv id16894 View details Tuvalu Other
    Ransomware www.go4kora.tv id33137 View details Tuvalu Other
    Ransomware www.go4kora.tv id33137 View details Tuvalu Other
    Ransomware www.go4kora.tv id16894 View details Tuvalu Other
    Ransomware www.rekamy.com id16893 View details Malaysia Other
    Ransomware www.rekamy.com id33138 View details Malaysia Other
    Ransomware www.rekamy.com id33138 View details Malaysia Other
    Ransomware www.rekamy.com id16893 View details Malaysia Other
    Ransomware www.dvttechnologyltd.com id16892 View details United States IT
    Ransomware www.dvttechnologyltd.com id33139 View details United States IT
    Ransomware www.dvttechnologyltd.com id33139 View details United States IT
    Ransomware www.dvttechnologyltd.com id16892 View details United States IT
    Ransomware www.siea.sk id16891 View details Slovakia Other
    Ransomware www.siea.sk id33140 View details Slovakia Other
    Ransomware www.siea.sk id33140 View details Slovakia Other
    Ransomware www.siea.sk id16891 View details Slovakia Other
    Ransomware www.spmundi.com.br id16890 View details Brazil Other
    Ransomware www.spmundi.com.br id33141 View details Brazil Other
    Ransomware www.spmundi.com.br id33141 View details Brazil Other
    Ransomware www.spmundi.com.br id16890 View details Brazil Other
    Ransomware www.merchant.id id16889 View details Indonesia Other
    Ransomware www.merchant.id id33142 View details Indonesia Other
    Ransomware www.merchant.id id33142 View details Indonesia Other
    Ransomware www.merchant.id id16889 View details Indonesia Other
    Ransomware www.cyncsolutions.com id16888 View details United States Services
    Ransomware www.cyncsolutions.com id33143 View details United States Services
    Ransomware www.cyncsolutions.com id33143 View details United States Services
    Ransomware www.cyncsolutions.com id16888 View details United States Services
    Ransomware Baca County Feedyard, Inc id16887 View details United States Public Sector
    Ransomware Baca County Feedyard, Inc id33144 View details United States Public Sector
    Ransomware Baca County Feedyard, Inc id33144 View details United States Public Sector
    Ransomware Baca County Feedyard, Inc id16887 View details United States Public Sector
    Ransomware www.skywaycoach.ca id16886 View details Canada Other
    Ransomware www.skywaycoach.ca id33145 View details Canada Other
    Ransomware www.skywaycoach.ca id33145 View details Canada Other
    Ransomware www.skywaycoach.ca id16886 View details Canada Other
    Ransomware www.farmaciaflorio.com id16885 View details Italy Agriculture / Food
    Ransomware www.farmaciaflorio.com id33146 View details Italy Agriculture / Food
    Ransomware www.farmaciaflorio.com id33146 View details Italy Agriculture / Food
    Ransomware www.farmaciaflorio.com id16885 View details Italy Agriculture / Food
    Ransomware www.nrshealthcare.com id16884 View details United Kingdom Healthcare / Pharma
    Ransomware www.nrshealthcare.com id33147 View details United Kingdom Healthcare / Pharma
    Ransomware www.nrshealthcare.com id33147 View details United Kingdom Healthcare / Pharma
    Ransomware www.nrshealthcare.com id16884 View details United Kingdom Healthcare / Pharma