Inactive ransomware operator
← All groupsBabuk
188 victims indexed · first seen 6 years ago · last activity 1 year ago
At a glance
- Status
- inactive
- First seen
- 6 years ago
- Last activity
- 1 year ago
- Onion sites
- 2 known endpoints
- Primary sector
- Public Sector · 43 hits
About
Timeline
6 monthsTop countries
Top sectors
MITRE ATT&CK
11 techniques · 8 tacticsTactics
Techniques
- T1566Phishing
- T1190Exploit Public-Facing Application
- T1059Command and Scripting Interpreter
- T1070Indicator Removal on Host
- T1082System Information Discovery
- T1083File and Directory Discovery
- T1021Remote Services
- T1005Data from Local System
- T1039Data from Network Shared Drive
- T1041Exfiltration Over C2 Channel
- T1486Data Encrypted for Impact
Detection · YARA rules
2 rulesRansom_Babuk
YARA rule from ATR/Trellix: ransomware/RANSOM_BabukLocker_Jan2021.yar
source: ATR/Trellix
RANSOM_Babuk_Packed_Feb2021
YARA rule from ATR/Trellix: ransomware/RANSOM_Babuk_Packed_Feb2021.yar
source: ATR/Trellix
Recent victims
Loading…
Onion infrastructure
2 known- http://nq4zyac4ukl4tykmidbzgdlvaboqeqsemkp4t35bzvjeve6zm2lqcjid.onion
- http://nq4zyac4ukl4tykmidbzgdlvaboqeqsemkp4t35bzvjeve6zm2lqcjid.onion/
Source
Updated 1 year agoData on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.
