Skip to main content
Darkfield

Operator dossier

babuk2 is a ransomware operator no longer publishing new disclosures. Darkfield has indexed 180 public victims claimed by this operator between January 27, 2025 and April 23, 2025. Babuk2 appears to be a recently emerged ransomware operation first observed in January 2025, representing either a new variant or successor to the original Babuk ransomware group, with apparent financial motivations based on their targeting patterns across multiple sectors and geographic regions. Given the limited timeframe since their emergence and the naming convention, this group likely operates independently or represents a rebrand/evolution of previous Babuk operations, though definitive attribution remains unclear due to the recency of their activities. Based on their targeting patterns across diverse sectors including public sector entities, technology companies, healthcare organizations, and manufacturing firms, the group appears to employ broad-spectrum attack methodologies typical of modern ransomware operations, though specific technical details regarding their initial access vectors, encryption methods, and extortion tactics have not yet been extensively documented by major security researchers. With 180 documented victims across multiple countries including significant activity in the United States, Brazil, India, Indonesia, and China within just the first month of 2025, Babuk2 has demonstrated a notably aggressive operational tempo, though specific high-profile incidents or ransom demands have not yet been publicly detailed by major cybersecurity firms or law enforcement agencies. The group appears to remain actively operational as of early 2025, though their recent emergence means long-term operational patterns and potential law enforcement responses are still developing.

Most-targeted sectors

Most-affected countries

Recent disclosures by babuk2

Most recent 150 of 180 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for babuk2 →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Inactive ransomware operator

← All groups

babuk2

180 victims indexed · first seen 1 year ago · last activity 1 year ago

180
Victims indexed
#50 of 364 tracked operators
3m
Active period
Jan 2025 → Apr 2025
10
Countries hit
top US · 32

At a glance

Status
inactive
First seen
1 year ago
Last activity
1 year ago
Primary sector
Public Sector · 43 hits

About

Babuk2 appears to be a recently emerged ransomware operation first observed in January 2025, representing either a new variant or successor to the original Babuk ransomware group, with apparent financial motivations based on their targeting patterns across multiple sectors and geographic regions. Given the limited timeframe since their emergence and the naming convention, this group likely operates independently or represents a rebrand/evolution of previous Babuk operations, though definitive attribution remains unclear due to the recency of their activities. Based on their targeting patterns across diverse sectors including public sector entities, technology companies, healthcare organizations, and manufacturing firms, the group appears to employ broad-spectrum attack methodologies typical of modern ransomware operations, though specific technical details regarding their initial access vectors, encryption methods, and extortion tactics have not yet been extensively documented by major security researchers. With 180 documented victims across multiple countries including significant activity in the United States, Brazil, India, Indonesia, and China within just the first month of 2025, Babuk2 has demonstrated a notably aggressive operational tempo, though specific high-profile incidents or ransom demands have not yet been publicly detailed by major cybersecurity firms or law enforcement agencies. The group appears to remain actively operational as of early 2025, though their recent emergence means long-term operational patterns and potential law enforcement responses are still developing.

Timeline

3 months
2025-01-01T00:00:00+00:00 · 662025-03-01T00:00:00+00:00 · 942025-04-01T00:00:00+00:00 · 20
2025-01-01T00:00:00+00:002025-04-01T00:00:00+00:00

Top countries

🇺🇸 United States
32
🇧🇷 Brazil
15
🇮🇳 India
10
🇮🇩 Indonesia
9
🇨🇳 China
7
🇹🇭 Thailand
5
Iraq
5
🇨🇦 Canada
4
United States dossier →Brazil dossier →India dossier →Indonesia dossier →

Top sectors

Public Sector
43
Technology
33
Healthcare
15
Manufacturing
12
Financial Services
9
Energy
7
Telecommunication
7
Agriculture and Food Production
6
Public Sector dossier →Technology dossier →Healthcare dossier →Manufacturing dossier →

MITRE ATT&CK

5 techniques · 4 tactics

Tactics

Initial AccessExecutionDefense EvasionImpact

Techniques

  • T1190Exploit Public-Facing Application
  • T1566Phishing
  • T1204User Execution
  • T1027Obfuscated Files or Information
  • T1486Data Encrypted for Impact

Recent victims

Loading…

Source

Updated 1 year ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time babuk2 posts a victim.

Add babuk2 to your watchlist — Pro pings you within 5 minutes of any new babuk2 leak-site post, Telegram callout, or affiliate-rebrand inference.