Overview
Platforms:
Windows · Linux
Variants:
Babuk · Babyk · Vasa Locker
Extensions:
—
ATT&CK software:
—
Initial access:
—
Top countries:
—
Observed sectors:
—
Tracked victims:
5
Attribution
Mikhail Matveev
VERIFIED
Alleged Babuk participant
U.S. authorities charged Matveev with participating in a conspiracy involving deployment of Babuk ransomware against the Metropolitan Police Department of the District of Columbia.
Affiliates
No affiliate information available.
Activity
Recent Observations
Babuk source code leaked
September 2021
Source-code event
Babuk ransomware source code for Windows, Linux and VMware ESXi-related tooling was leaked publicly and subsequently reused by other ransomware operations.
Babuk announces ransomware shutdown
April 2021
Operational closure
Following increased attention after the Washington D.C. police attack, Babuk announced plans to end its ransomware operation.
Washington D.C. Metropolitan Police attack
April 2021
Major incident
Babuk ransomware was deployed against the Metropolitan Police Department of the District of Columbia and stolen information was used for extortion.
TTPs
ATT&CK coverage:
7 techniques
· 4 tactics
T1059.003
Windows Command Shell
VERIFIEDExecution
Babuk can use the Windows command line to control execution on compromised hosts.
T1685
Disable or Modify Tools
VERIFIEDDefense Evasion
Babuk can stop antivirus services before encryption.
T1057
Process Discovery
VERIFIEDDiscovery
Babuk can enumerate running processes on compromised systems.
Show more TTPs (4)
T1135
Network Share Discovery
VERIFIEDDiscovery
Babuk can enumerate accessible network shares for encryption.
T1489
Service Stop
VERIFIEDImpact
Babuk can stop backup-related and other services that may interfere with file encryption.
T1490
Inhibit System Recovery
VERIFIEDImpact
Babuk deletes Windows volume shadow copies using vssadmin to hinder recovery.
T1486
Data Encrypted for Impact
VERIFIEDImpact
Babuk encrypts victim data using ChaCha8 and ECDH-based cryptographic mechanisms.
Victims
Metropolitan Police Department of the District of Columbia
CONFIRMED
Government organization in United States.
CVEs
No CVE associations available.
Infrastructure
Babuk leak site
Babuk operated leak infrastructure to publish stolen victim information as part of its double-extortion model.
Ransomware platform
Babuk operated as a ransomware-as-a-service ecosystem supporting big-game hunting against enterprise targets.
Babuk leak site
After the original operation ceased, leaked Babuk source code was reused by numerous unrelated ransomware families, particularly for VMware ESXi encryption.
Timeline
2023-05
Babuk code remains widely reused
SentinelOne identified numerous ransomware families using ESXi lockers derived from the leaked Babuk code.
2021-09
Babuk source code leaked
The ransomware source code was leaked publicly, including components for Windows, Linux, NAS and VMware ESXi environments.
2021-04
Washington D.C. police attack
Babuk ransomware was deployed against the Metropolitan Police Department of the District of Columbia on April 26.
Show more events (2)
2021-04
Shutdown announced
Babuk announced its intention to terminate the ransomware operation following increased law-enforcement attention.
2020-12
Babuk first appears
U.S. authorities date the first appearance of the Babuk ransomware variant to approximately December 2020.
Sources
Russian National Charged with Ransomware Attacks Against Critical Infrastructure
U.S. Department of Justice
Ransomware Charges Unsealed Against Russian National
U.S. Department of Justice
Show more sources (3)
Babuk ransomware readies shut down post, plans to open source malware
BleepingComputer
Incident report