Ransomware Group intelligence
Babuk2
InactiveTrack Babuk2 with 370 published victims and 4 known leak locations in a single intelligence view.
DARK EYE ALERTS
Want an alert every time a new ransomware post is published?
Choose the feeds and the countries you care about — we email you when they move.
Overview
Babuk2 is tracked by Dark Eye as a ransomware group with 370 published victims.
United States is currently the most targeted country in this dataset.
4 known leak locations are currently associated with this group.
Leak Status Distribution
370
- Leaked 2 0.5%
- Pending 368 99.5%
- Deleted 0 0.0%
Top Countries
Interactive distribution based on the currently visible victims list.
Known Leak Locations (4)
| Label | Type | Availability | Links |
|---|---|---|---|
| Leak location 3 | Web location | Down checked 1h ago | 212.24.99.211. |
| Leak location 4 | Web location | Down checked 1h ago | 5g2e.l.time4vps.cloud |
| Leak location 2 | Onion service | Down checked 1h ago | bxwu33iefqfc3rxigynn3ghvq4gdw3gxgxna5m4aa3o4vscdeeqhiqad.onion |
| Leak location 1 | Onion service | Down checked 1h ago | 7dikawx73goypgfi4zyo5fcajxwb7agemmiwqax3p54aey4dwobcvcyd.onion |
Top Activity Sectors (17)
- Not identified 102
- Services 17
- Public Sector 13
- Communication / Marketing 10
- Healthcare / Pharma 9
- Finance / Legal / Insurance 9
- Retail / E-commerce 6
- Manufacturing / Engineering 5
- IT 5
- Construction / Real Estate 3
- Agriculture / Food 3
- Telecommunications 3
- Energy 2
- Transportation / Travel / Logistics 2
- Education 2
- NGOs / Associations 1
- Hospitality / Food & Beverage / Tourism 1
Typical Attacks (12)
▼MITRE ATT&CK does not currently catalogue Babuk2, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v20.0. Confidence: medium. Treat it as orientation, not attribution.
-
T1059.001 PowerShell Execution
What they do: babuk2 uses PowerShell scripts to execute malicious commands and deploy ransomware payloads across compromised systems.
What that means: Adversaries may abuse PowerShell commands and scripts for execution.
-
What they do: babuk2 modifies Windows Registry Run keys to ensure ransomware execution upon system reboot for persistence.
What that means: Adversaries may interact with the Windows Registry as part of a variety of other techniques to aid in defense evasion, persistence, and execution.
-
What they do: babuk2 leverages registry run keys and startup folders to maintain persistence across reboots.
What that means: Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key.
-
T1685 Disable or Modify Tools Defense Impairment
What they do: babuk2 disables security tools like antivirus software and monitoring agents to evade detection during infection.
What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
-
T1688 Safe Mode Boot Defense Impairment
What they do: babuk2 manipulates boot sequence via Safe Mode Boot techniques to bypass initial security checks during execution.
What that means: Adversaries may abuse Windows safe mode to disable endpoint defenses.
-
T1027.013 Encrypted/Encoded File Stealth
What they do: babuk2 encrypts and encodes victim files with custom ransomware keys to ensure irreversible data access denial.
What that means: Adversaries may encrypt or encode files to obfuscate strings, bytes, and other specific patterns to impede detection.
-
T1070.004 File Deletion Stealth
What they do: babuk2 deletes Volume Shadow Copies and backup files via system commands to prevent data recovery.
What that means: Adversaries may delete files left behind by the actions of their intrusion activity.
-
T1018 Remote System Discovery Discovery
What they do: babuk2 discovers remote systems via network scanning to expand foothold across victim networks.
What that means: Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system.
-
T1135 Network Share Discovery Discovery
What they do: babuk2 performs network share discovery to identify accessible SMB shares for lateral movement and victim targeting.
What that means: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.
-
T1021.002 SMB/Windows Admin Shares Lateral Movement
What they do: babuk2 uses SMB/Windows Admin Shares for lateral movement between compromised hosts within the network.
What that means: Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).
-
T1486 Data Encrypted for Impact Impact
What they do: babuk2 encrypts victim files using strong symmetric encryption to maximize impact and trigger ransom demands.
What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
-
T1490 Inhibit System Recovery Impact
What they do: babuk2 calls system recovery inhibitors like shutdown scripts to prevent victim systems from restoring functionality.
What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.
Victims (370)
Search, filter and paginate the victim timeline for Babuk2. Showing 201–300 of 370.
| Type | Target | Discovered | Country | Business Category | Intel Link | Leak status |
|---|---|---|---|---|---|---|
| Ransomware | Iraqi Ministry of Finance id33070 | Iraq | Finance / Legal / Insurance | pending | ||
|
Iraqi Ministry of Finance |
||||||
| Ransomware | Iraqi Council of Ministers id18383 View details | Iraq | Public Sector | pending | ||
|
Iraqi Council of Ministers |
||||||
| Ransomware | Iraqi Council of Ministers id33071 | Iraq | Public Sector | pending | ||
|
Iraqi Council of Ministers |
||||||
| Ransomware | marinabaysands.com - Singapore Hotel (Internal Server) id18373 View details | Singapore | Hospitality / Food & Beverage / Tourism | pending | ||
|
marinabaysands.com - Singapore Hotel (Internal Server) |
||||||
| Ransomware | marinabaysands.com - Singapore Hotel (Internal Server) id33073 | Singapore | Hospitality / Food & Beverage / Tourism | pending | ||
|
marinabaysands.com - Singapore Hotel (Internal Server) |
||||||
| Ransomware | hitekgroup.in india Finance id18368 View details | India | Finance / Legal / Insurance | pending | ||
|
hitekgroup.in india Finance |
||||||
| Ransomware | hitekgroup.in india Finance id33074 | India | Finance / Legal / Insurance | pending | ||
|
hitekgroup.in india Finance |
||||||
| Ransomware | India's telecommunication network id18362 View details | India | Telecommunications | pending | ||
|
India's telecommunication network |
||||||
| Ransomware | India's telecommunication network id33075 | India | Telecommunications | pending | ||
|
India's telecommunication network |
||||||
| Ransomware | Babuk Locker 2.0 affiliate program 2025 id18358 View details | United Kingdom | Communication / Marketing | pending | ||
|
Babuk Locker 2.0 affiliate program 2025 refers to a 2025 ransomware brand and affiliate-style extortion operation that security researchers describe as a reworked campaign rather than a true Babuk revival. Reporting says it used Telegram channels to recruit affiliates, promote double-extortion services, and publicize alleged victim listings across multiple sectors. The entity is associated with the GB communication and marketing sector in victim-tracking context, reflecting how the listing is cataloged rather than a confirmed public company disclosure. It was listed as a ransomware victim associated with babuk2. |
||||||
| Ransomware | Baykar Turkish defense company C4I and artificial intelligence id18349 View details | Türkiye | Services | pending | ||
|
Baykar Turkish defense company C4I and artificial intelligence By Babuk Locker 2.0 |
||||||
| Ransomware | Baykar Turkish defense company C4I and artificial intelligence id33076 | Türkiye | Services | pending | ||
|
Baykar Turkish defense company C4I and artificial intelligence By Babuk Locker 2.0 |
||||||
| Ransomware | wapda.gov.pk By Babuk Locker 2.0 id18316 View details | Pakistan | Other | pending | ||
|
wapda.gov.pk is the official website of the Water and Power Development Authority (WAPDA), a Pakistani government-owned public utility agency based in Lahore, Punjab. WAPDA’s mandate covers the development and management of water and hydropower resources in Pakistan. Its online presence supports the authority’s public information, operational, and organizational functions. The entity was listed as a ransomware victim associated with babuk2. |
||||||
| Ransomware | airexplore.aero Company id18325 View details | Slovakia | Services | pending | ||
|
airexplore.aero Company |
||||||
| Ransomware | airexplore.aero Company id33077 | Slovakia | Services | pending | ||
|
airexplore.aero Company |
||||||
| Ransomware | fnde.gov.br brazilian government id18317 View details | Brazil | Public Sector | pending | ||
|
fnde.gov.br brazilian government |
||||||
| Ransomware | fnde.gov.br brazilian government id33078 | Brazil | Public Sector | pending | ||
|
fnde.gov.br brazilian government |
||||||
| Ransomware | wapda.gov.pk id18321 View details | Pakistan | Other | pending | ||
|
wapda.gov.pk By Babuk Locker 2.0 |
||||||
| Ransomware | wapda.gov.pk id33079 | Pakistan | Other | pending | ||
|
wapda.gov.pk By Babuk Locker 2.0 |
||||||
| Ransomware | lexmark.com Company id18315 View details | United States | Services | pending | ||
|
lexmark.com Company |
||||||
| Ransomware | lexmark.com Company id33080 | United States | Services | pending | ||
|
lexmark.com Company |
||||||
| Ransomware | forvismazars.com.fr ( mazars.fr ) By Babuk Locker 2.0 id18313 View details | France | Other | pending | ||
|
forvismazars.com.fr is the French website of Forvis Mazars, an international partnership headquartered in France. The firm provides audit, accounting, tax, and advisory services to businesses and other organizations, and operates from Levallois-Perret in the Paris area. Forvis Mazars describes itself as an integrated partnership active in more than 100 countries and territories, with a broad professional-services offering. In threat-intelligence indexing, it was listed as a ransomware victim associated with babuk2. |
||||||
| Ransomware | forvismazars.com.fr ( mazars.fr ) id18348 View details | France | Other | pending | ||
|
forvismazars.com.fr ( mazars.fr ) By Babuk Locker 2.0 |
||||||
| Ransomware | forvismazars.com.fr ( mazars.fr ) id33081 | France | Other | pending | ||
|
forvismazars.com.fr ( mazars.fr ) By Babuk Locker 2.0 |
||||||
| Ransomware | petstop.com Company id18311 View details | United States | Services | pending | ||
|
petstop.com Company |
||||||
| Ransomware | petstop.com Company id33082 | United States | Services | pending | ||
|
petstop.com Company |
||||||
| Ransomware | misaludhealth.com By Babuk Locker 2.0 id18310 View details | United Kingdom | Healthcare / Pharma | pending | ||
|
misaludhealth.com is the digital platform for MiSalud Health, a San Francisco-based bilingual telehealth provider serving the Latinx community in the United States. The company offers Spanish-first virtual care, including on-demand consultations, same-day appointments, and behavioral health services through employers. Its offerings curate culturally appropriate healthcare services, providing access to U.S. licensed physicians and health coaches via video, phone, and messaging. The platform recently announced a GLP-1 support program to expand inclusive care access. misaludhealth.com was listed as a ransomware victim associated with the threat actor babuk2. |
||||||
| Ransomware | misaludhealth.com id18347 View details | United States | Healthcare / Pharma | pending | ||
|
misaludhealth.com By Babuk Locker 2.0 |
||||||
| Ransomware | misaludhealth.com id33083 | United States | Healthcare / Pharma | pending | ||
|
misaludhealth.com By Babuk Locker 2.0 |
||||||
| Ransomware | bank.pingan.com (CN) By Babuk Locker 2.0 id18309 View details | China | Finance / Legal / Insurance | pending | ||
|
bank.pingan.com is the official website of Ping An Bank Co., Ltd., a Chinese joint-stock commercial bank headquartered in Shenzhen, China. It serves retail and corporate customers with diversified banking services, including online banking, enterprise banking, supply chain finance, and integrated onshore and offshore financial services. The bank operates through a broad branch and outlet network across China and maintains English-language access for digital banking and corporate business information. It was listed as a ransomware victim associated with babuk2. |
||||||
| Ransomware | bank.pingan.com (CN) id18346 View details | China | Finance / Legal / Insurance | pending | ||
|
bank.pingan.com |
||||||
| Ransomware | bank.pingan.com (CN) id33084 | China | Finance / Legal / Insurance | pending | ||
|
bank.pingan.com |
||||||
| Ransomware | Access to Indian Ministry of Defence and Military Secret (DRDO) documents By Babuk Locker ... id18308 View details | India | Public Sector | pending | ||
|
Access to Indian Ministry of Defence and Military Secret (DRDO) documents By Babuk Locker 2.0 |
||||||
| Ransomware | Access to Indian Ministry of Defence and Military Secret (DRDO) documents By Babuk Locker ... id33085 | India | Public Sector | pending | ||
|
Access to Indian Ministry of Defence and Military Secret (DRDO) documents By Babuk Locker 2.0 |
||||||
| Ransomware | Mandarin.com.br By Babuk Locker 2.0 id18305 View details | Brazil | Other | pending | ||
|
Agência Mandarin is a shopper marketing and health marketing agency based in São Paulo, Brazil, specializing in sales conversion through proprietary methodologies. The agency transforms storefront facades into e-commerce access links via revitalization projects, serving clients in retail and health sectors. Founded in 2004 with 11 to 50 employees, it operates from Rua Luís Correia de Melo 92 in São Paulo. The agency was listed as a ransomware victim associated with the threat actor babuk2. |
||||||
| Ransomware | Mandarin.com.br id18345 View details | Brazil | Other | pending | ||
|
Mandarin.com.br |
||||||
| Ransomware | Mandarin.com.br id33086 | Brazil | Other | pending | ||
|
Mandarin.com.br |
||||||
| Ransomware | mazars.fr id18296 View details | France | Other | pending | ||
|
mazars.fr company |
||||||
| Ransomware | mazars.fr id33087 | France | Other | pending | ||
|
mazars.fr company |
||||||
| Ransomware | INDONESIA TAXPAYER IDENTIFICATION NUMBER (NPWP) id16958 View details | Indonesia | Other | pending | ||
|
INDONESIA TAXPAYER IDENTIFICATION NUMBER (NPWP) |
||||||
| Ransomware | INDONESIA TAXPAYER IDENTIFICATION NUMBER (NPWP) id33093 | Indonesia | Other | pending | ||
|
INDONESIA TAXPAYER IDENTIFICATION NUMBER (NPWP) |
||||||
| Ransomware | MYINDIHOME TELKOM INDONESIA by ( Babuk Locker ) id16956 View details | Indonesia | Other | pending | ||
|
MYINDIHOME TELKOM INDONESIA |
||||||
| Ransomware | MYINDIHOME TELKOM INDONESIA by ( Babuk Locker ) id33094 | Indonesia | Other | pending | ||
|
MYINDIHOME TELKOM INDONESIA |
||||||
| Ransomware | MYINDIHOME TELKOM INDONESIA id16951 View details | Indonesia | Other | pending | ||
|
MYINDIHOME TELKOM INDONESIA |
||||||
| Ransomware | MYINDIHOME TELKOM INDONESIA id33095 | Indonesia | Other | pending | ||
|
MYINDIHOME TELKOM INDONESIA |
||||||
| Ransomware | MYPERTAMINA INDONESIA id16947 View details | Indonesia | Other | pending | ||
|
MYPERTAMINA INDONESIA |
||||||
| Ransomware | MYPERTAMINA INDONESIA id33096 | Indonesia | Other | pending | ||
|
MYPERTAMINA INDONESIA |
||||||
| Ransomware | copral.com.br id16936 View details | Brazil | Communication / Marketing | pending | ||
|
Greetings! copral.com.br Today we are posting here the new company, "Copral Comercio e Navegacao LTDA". |
||||||
| Ransomware | copral.com.br id33097 | Brazil | Communication / Marketing | pending | ||
|
Greetings! copral.com.br Today we are posting here the new company, "Copral Comercio e Navegacao LTDA". |
||||||
| Ransomware | human.de id16933 View details | Germany | Communication / Marketing | pending | ||
|
HUMAN, founded in 1972, is a Germany based privately owned company which develops, manufactures and distributes a wide range of IVD Diagnostics and laboratory equipment. |
||||||
| Ransomware | human.de id33098 | Germany | Communication / Marketing | pending | ||
|
HUMAN, founded in 1972, is a Germany based privately owned company which develops, manufactures and distributes a wide range of IVD Diagnostics and laboratory equipment. |
||||||
| Ransomware | bocagroup.com id16932 View details | United States | Construction / Real Estate | pending | ||
|
As America's premier elevator and escalator consulting company, BOCA Group is the partner of choice for the biggest and best-known building owners and developer |
||||||
| Ransomware | bocagroup.com id33099 | United States | Construction / Real Estate | pending | ||
|
As America's premier elevator and escalator consulting company, BOCA Group is the partner of choice for the biggest and best-known building owners and developer |
||||||
| Ransomware | alentec.com id16931 View details | Sweden | Telecommunications | pending | ||
|
This is a public request for Alentec & Orion AB, you don't have much time left to get in touch with us and help you resolve your security problems, we also continue to be in your networks and monitor you |
||||||
| Ransomware | alentec.com id33100 | Sweden | Telecommunications | pending | ||
|
This is a public request for Alentec & Orion AB, you don't have much time left to get in touch with us and help you resolve your security problems, we also continue to be in your networks and monitor you |
||||||
| Ransomware | Württemberger Medien id16930 View details | Germany | IT | pending | ||
|
Lassen Sie sich kostenlos von unseren Experten aus Stuttgart beraten. Digitalisierung geht schnell und einfach - Wir haben Lösungen für den Mittelstand! |
||||||
| Ransomware | Württemberger Medien id33101 | Germany | IT | pending | ||
|
Lassen Sie sich kostenlos von unseren Experten aus Stuttgart beraten. Digitalisierung geht schnell und einfach - Wir haben Lösungen für den Mittelstand! |
||||||
| Ransomware | viacaojacarei.com.br id16929 View details | Brazil | Other | pending | ||
|
viacaojacarei.com.br |
||||||
| Ransomware | viacaojacarei.com.br id33102 | Brazil | Other | pending | ||
|
viacaojacarei.com.br |
||||||
| Ransomware | gelco-s-a.com.br id16928 View details | Brazil | Other | pending | ||
|
gelco-s-a.com.br |
||||||
| Ransomware | gelco-s-a.com.br id33103 | Brazil | Other | pending | ||
|
gelco-s-a.com.br |
||||||
| Ransomware | Kurosu & Co.SA - kurosu.com.py id16927 View details | Paraguay | Other | pending | ||
|
Kurosu & Co.SA - kurosu.com.py LEAKED |
||||||
| Ransomware | Kurosu & Co.SA - kurosu.com.py id33104 | Paraguay | Other | pending | ||
|
Kurosu & Co.SA - kurosu.com.py LEAKED |
||||||
| Ransomware | zapopan.gob.mx id16926 View details | Mexico | Other | pending | ||
|
zapopan.gob |
||||||
| Ransomware | zapopan.gob.mx id33105 | Mexico | Other | pending | ||
|
zapopan.gob |
||||||
| Ransomware | carc.gov.jo id16925 View details | Jordan | Other | pending | ||
|
carc.gov |
||||||
| Ransomware | carc.gov.jo id33106 | Jordan | Other | pending | ||
|
carc.gov |
||||||
| Ransomware | nhbg.com.co id16924 View details | Colombia | Other | pending | ||
|
nhbg |
||||||
| Ransomware | nhbg.com.co id33107 | Colombia | Other | pending | ||
|
nhbg |
||||||
| Ransomware | APMS ( Advanced Physician Management Service LLC id16923 View details | United States | Services | pending | ||
|
APMS ( Advanced Physician Management Service LLC |
||||||
| Ransomware | APMS ( Advanced Physician Management Service LLC id33108 | United States | Services | pending | ||
|
APMS ( Advanced Physician Management Service LLC |
||||||
| Ransomware | a top-tier law firm in Workers Compensation Defense! id16922 View details | — | Finance / Legal / Insurance | pending | ||
|
a top-tier law firm in Workers Compensation Defense! |
||||||
| Ransomware | a top-tier law firm in Workers Compensation Defense! id33109 | United States | Finance / Legal / Insurance | pending | ||
|
a top-tier law firm in Workers Compensation Defense! |
||||||
| Ransomware | precisediagnosticspacs.com id16921 View details | United States | Communication / Marketing | pending | ||
|
precisediagnosticspacs.com |
||||||
| Ransomware | precisediagnosticspacs.com id33110 | United States | Communication / Marketing | pending | ||
|
precisediagnosticspacs.com |
||||||
| Ransomware | zetech.ac.ke id16920 View details | Kenya | IT | pending | ||
|
zetech.ac.ke |
||||||
| Ransomware | zetech.ac.ke id33111 | Kenya | IT | pending | ||
|
zetech.ac.ke |
||||||
| Ransomware | maxprofit.mcode.me id16919 View details | — | Communication / Marketing | pending | ||
|
maxprofit.mcode.me |
||||||
| Ransomware | maxprofit.mcode.me id33112 | France | Communication / Marketing | pending | ||
|
maxprofit.mcode.me |
||||||
| Ransomware | skopje.gov.mk id16918 View details | North Macedonia | Other | pending | ||
|
skopje.gov.mk |
||||||
| Ransomware | skopje.gov.mk id33113 | North Macedonia | Other | pending | ||
|
skopje.gov.mk |
||||||
| Ransomware | rtdc.gov.mn id16917 View details | Mongolia | Other | pending | ||
|
rtdc.gov.mn access |
||||||
| Ransomware | rtdc.gov.mn id33114 | Mongolia | Other | pending | ||
|
rtdc.gov.mn access |
||||||
| Ransomware | pbos.gov.pk id16916 View details | Pakistan | Other | pending | ||
|
pbos.gov.pk |
||||||
| Ransomware | pbos.gov.pk id33115 | Pakistan | Other | pending | ||
|
pbos.gov.pk |
||||||
| Ransomware | abd-ong.org id16915 View details | Spain | Other | pending | ||
|
abd-ong.org |
||||||
| Ransomware | abd-ong.org id33116 | Spain | Other | pending | ||
|
abd-ong.org |
||||||
| Ransomware | mtgazeta.uz id16914 View details | Uzbekistan | Other | pending | ||
|
mtgazeta.uz |
||||||
| Ransomware | mtgazeta.uz id33117 | Uzbekistan | Other | pending | ||
|
mtgazeta.uz |
||||||
| Ransomware | sincorpe.org.br id16913 View details | Brazil | Services | pending | ||
|
sincorpe.org.br |
||||||
| Ransomware | sincorpe.org.br id33118 | Brazil | Services | pending | ||
|
sincorpe.org.br |
||||||
| Ransomware | pti.agency id16912 View details | Germany | Communication / Marketing | pending | ||
|
pti.agency |
||||||
| Ransomware | pti.agency id33119 | Germany | Communication / Marketing | pending | ||
|
pti.agency |
||||||
| Ransomware | singularanalysts.com id16911 View details | United States | Other | pending | ||
|
singularanalysts.com |
||||||
| Ransomware | singularanalysts.com id33120 | United States | Other | pending | ||
|
singularanalysts.com |
||||||
| Ransomware | gervetusa.com id16910 View details | United States | Other | pending | ||
|
gervetusa.com |
||||||
| Ransomware | gervetusa.com id33121 | United States | Other | pending | ||
|
gervetusa.com |
||||||
| Ransomware | workers.com.zm id16909 View details | Zambia | Other | pending | ||
|
workers.com.zm |
||||||
| Ransomware | workers.com.zm id33122 | Zambia | Other | pending | ||
|
workers.com.zm |
||||||
| Ransomware | wacer.com.au id16908 View details | Australia | Other | pending | ||
|
wacer.com.au |
||||||