Fraud Management & Cybercrime
,
Ransomware
What Do You Mean, Hospital-Targeting Sociopath Ransomware Wielders Continue to Lie?
It never hurts to be reminded: ransomware hackers are lying liars who continue to lie.
See Also: Future-Proof Your Business: A Comprehensive Guide to Application Modernization and Development for Public and Private Sectors
An emerging ransomware group going by the name of Babuk or Babuk2 has been attempting to bolster its reputation by claiming dozens of new victims. “Hello World today we attacked 26 companies and stole some company information,” the group said in a Thursday post to its data leak blog, naming just some of the supposed victims as Amazon.com, Cardinal Health, Delta, HSBC, Schwab and US Bank.
The group claimed to have stolen “around 100 terabytes of confidential document information” from each company that “will destroy the company’s reputation, and the company will go bankrupt. Some users have bought information but only part of the information from each party.” It demanded the victims pay a ransom within a month or it would dump the data.
Not so fast: “Many of these organizations were previously targeted by the Cl0p ransomware group exploiting the MOVEit vulnerability – CVE-2023-34362 – in mid-2023,” said Milivoj Rajić, head of threat intelligence at DynaRisk. “They might be attempting to take credit for breaches executed by Cl0p.”
Clop, aka Cl0p, targeted a zero-day MOVEit vulnerability over the U.S. Memorial Day weekend in 2023 to directly or indirectly steal data pertaining to over 95 million organizations, collected by more than 2,700 organizations, calculates cybersecurity firm Emsisoft. Experts said the group may have earned $75 million to $100 million in hush money payments from affected organizations (see: Feds Drop Probe Into Progress Software Over MOVEit Zero-Day).
By contrast, the ransomware-as-a-service group calling itself Babuk that first appeared in January may be pedaling nothing more than hot air.
Ransomware groups are caught out by their lies all the time. Operators play fast and loose with who they attacked, how many victims they amassed, and what they stole or not, all to make themselves seem really big and bad, and so pressure more victims into paying.
“The new operation seems to use the Babuk name for credibility,” cybersecurity firm Halcyon said in a Tuesday blog post. “It’s administrator, known as Bjorka, has been active on various forums and Telegram and has previously been associated with other data breaches and extortion attempts.”
The original Babuk, which issued communications beginning with “Hello World,” went dark in 2021 after attacking the Washington D.C. Metropolitan Police Department.
One of the original Babuk’s parting moves was to release the source code for its ransomware builder in June 2021, which included the ability to encrypt Windows and ESXi systems. As with leaked LockBit and Conti source code, the builder has since been reused by a number of attackers and groups. Other groups go farther and use bits of the builder to cobble together their own Frankenstein’s monster ransomware, borrowing crypto-locking malware from one, a data exfiltration tool from another, adding in a ransom note variation and command-and-control infrastructure to run it all, and so on.
The new Babuk has clearly been trying to build a name for itself since security researchers first spotted the group in late January.
“Babuk has been leaking a large number of databases, allegedly belonging to private companies as well as government and defense sectors,” Rajić told Information Security Media Group. “However, for some of these databases, it is not possible to verify the validity of the data, which once again raises questions about how legitimate Babuk’s claims really are.”
Rajić said the group recently announced an affiliate program called Babuk 2.0, aka Babuk-Bjorka, “allowing other threat actors to use their ransomware tools in exchange for a share of the ransom.”
Whether or not the group is actually wielding any type of ransomware isn’t clear. “Despite the group’s claims of having conducted multiple attacks in early 2025, our analysis indicates there is no evidence of new, live ransomware encryption or fresh network intrusions,” Halcyon said. “Instead, the data appears to be recycled from past incidents.”
Despite the group’s relatively recent debut, Babuk2 continues to get called out for apparently trying to recycle someone else’s attacks.
Consultancy GuidePoint Security in January reported counting at least 57 victims claimed by the group “where the victim organization description and details provided on the Babuk2’s data leak site were an exact match for the original claim by a different threat group,” including FunkSec, RansomHub, LockBit and Meow.
“For organizations listed on the Babuk2 DLS or contacted by alleged affiliates, we highly recommend verifying any alleged intrusion and ruling out possible recycling of past leaked data,” GuidePoint Security said. The organization said it’s seen a surge in the past year by “unsophisticated threat actors repurposing formerly breached data to coerce payment in cases where no additional intrusion by the threat actor has taken place.”
As always, never take at face value liars or the lies they tell.