Exfiltration
- File[.]io
Babuk
Babuk is a ransomware family and ransomware codebase that became especially influential after its 2021 source-code leak, which enabled widespread reuse by other criminal operations and accelerated the development of Linux, ESXi, and NAS-targeting lockers.
Profile source: Mallory opens in a new tabBabuk
Family profile
Babuk is a ransomware family and ransomware codebase that became especially influential after its 2021 source-code leak, which enabled widespread reuse by other criminal operations and accelerated the development of Linux, ESXi, and NAS-targeting lockers. It is associated with financially motivated extortion activity and has been used directly by some threat actors while also serving as the foundation for numerous derivative strains and ransomware-as-a-service variants. Babuk is frequently referenced in relation to later families and campaigns because operators have reused or adapted its encryption logic, builder components, and platform-specific implementations rather than developing bespoke ransomware from scratch.
Babuk is known to target Windows and Linux-based environments, including VMware ESXi and NAS systems. Reporting on the leaked code indicates separate tooling for Windows and ESXi/Linux-oriented deployments, and subsequent threat activity has repeatedly involved Babuk-derived lockers against virtualized infrastructure. This made Babuk particularly significant in the evolution of enterprise ransomware, as its leaked code lowered the barrier to entry for actors seeking to attack hypervisors and other non-Windows platforms.
Observed Babuk-related tradecraft includes file encryption for impact and, in some cases, use by actors conducting extortion operations. Babuk has also been linked to defense-evasion behavior through DLL sideloading, including abuse of a legitimate Windows debugger to load ransomware on victim systems. Multiple later groups have reportedly reverse-engineered Babuk samples or reused its leaked source to inherit encryption routines, obfuscation approaches, and evasion techniques. Because of this extensive code reuse, attribution of Babuk-labeled samples can be difficult: detections may reflect true Babuk deployments, Babuk-family variants, or unrelated ransomware built from the leaked source.
Babuk has appeared in operations affecting enterprise environments, including attacks involving Linux and ESXi systems, and has been used by or alongside other ransomware actors targeting organizations across multiple sectors. Its long-term significance lies less in any single campaign than in its role as a foundational ransomware lineage whose leaked source materially shaped the broader ransomware ecosystem.
Capabilities
- Defense Evasion
- Dll Sideloading
- Extortion
Operational record
1
YARA rules
2
Negotiations
1
Leak sites
0 available
Reported operators
Threat actors
22 named in public reportingCe groupe utilisait auparavant des ransomwares tiers (RedAlert, LockBit, Babuk).
...для шифрования файлов — LockBit 3 (Black) и Babuk...
...для шифрования файлов — LockBit 3 (Black) и Babuk...
...для шифрования файлов — LockBit 3 (Black) и Babuk...
Talos IR responded to Warlock, Babuk and Kraken ransomware variants for the first time... Notably, we also observed evidence of Babuk ransomware files on the customer’s network in this engagement, which has not been previously deployed by Storm-2603 according to public reporting, though it failed to encrypt and only renamed files.
As in previous attacks, they encrypted data using variants of LockBit 3.0 (for Windows systems) and Babuk (for NAS devices).
As the final payload, the group used the well-known ransomware LockBit 3.0 and Babuk.
As the final payload, the group used the well-known ransomware LockBit 3.0 and Babuk.
SentinelLABS observed an increase in VMware ESXi ransomware based on Babuk ( aka Babak, Babyk). The Babuk leaks in September 2021 provided unprecedented insight into the development operations of an organized ransomware group.
Authorities say Matveev played a major role in the development and deployment of the Hive, LockBit and Babuk ransomware variants...
On Dec. 31, 2020, they announced the creation of the Babuk ransomware affiliate program... On January 1, 2021, a new user “Babuk” registered on the crime forum Verified... “We run an affiliate program,” Babuk explained in their introductory post on Verified.
On Dec. 31, 2020, they announced the creation of the Babuk ransomware affiliate program... On January 1, 2021, a new user “Babuk” registered on the crime forum Verified... “We run an affiliate program,” Babuk explained in their introductory post on Verified.
On Dec. 31, 2020, they announced the creation of the Babuk ransomware affiliate program... On January 1, 2021, a new user “Babuk” registered on the crime forum Verified... “We run an affiliate program,” Babuk explained in their introductory post on Verified.
The hacking group was first documented by F6 in September 2025 as leveraging encryptors associated with LockBit 3 (Black) and Babuk.
Warlock has employed multiple different encryptors over time, ranging from custom ones to variants based on Babyk...
"...others support or sell ESXi encryptors like Akira, Black Basta, Babuk, Lockbit, and Kuiper."
"...others support or sell ESXi encryptors like Akira, Black Basta, Babuk, Lockbit, and Kuiper."
"...others support or sell ESXi encryptors like Akira, Black Basta, Babuk, Lockbit, and Kuiper."
...used open-source and leaked builders from other operators, including LockBit, Babuk and Conti.
"...others support or sell ESXi encryptors like Akira, Black Basta, Babuk, Lockbit, and Kuiper."
Lockers such as Babuk and LockBit.
...deploying multiple strains of ransomware based on the leaked Babuk source code.
Exploited software
Vulnerabilities linked to Babuk
3 CVEsMITRE ATT&CK
Babuk in ATT&CK
29 distinct techniquesTechniques
29 techniques T1027 Obfuscated Files or Information T1486 Data Encrypted for Impact T1083 File and Directory Discovery T1082 System Information Discovery T1567 Exfiltration Over Web Service T1036 Masquerading T1105 Ingress Tool Transfer T1140 Deobfuscate/Decode Files or Information T1529 System Shutdown/Reboot T1190 Exploit Public-Facing Application T1021.004 SSH T1657 Financial Theft T1059.003 Windows Command Shell T1057 Process Discovery T1562 Impair Defenses T1490 Inhibit System Recovery T1537 Transfer Data to Cloud Account T1497.001 System Checks T1048 Exfiltration Over Alternative Protocol T1562.001 Disable or Modify Tools T1489 Service Stop T1027.002 Software Packing T1120 Peripheral Device Discovery T1007 System Service Discovery T1078 Valid Accounts T1106 Native API T1049 System Network Connections Discovery T1135 Network Share Discovery T1680 Local Storage Discovery
Reporting
Research mentioning Babuk
Jul 30
Malware News
Toy Ghouls’ new toy: the GenieLocker ransomware - Malware News - Malware Analysis, News and Indicators
Researchers reported that the financially motivated Toy Ghouls group has deployed a new custom ransomware family, GenieLocker, against organizations in the Russian Federation, with manufacturing firms highlighted among the victims. Active since March 2026, the malware marks a shift away from third-party ransomware such as RedAlert, LockBit, and Babuk to a cross-platform encryptor built for Windows, Linux, and VMware ESXi environments. In a documented intrusion, the attackers reportedly entered through an OpenVPN connection belonging to a trusted external partner by using stolen valid credentials, then expanded access with OpenSSH, SoftPerfect Network Scanner, Mimikatz, PsExec, and PAExec. The Windows variant uses anti-debugging protections, requires a secret launch argument, terminates processes and services, and encrypts data with libsodium implementations of XChaCha20-Poly1305 and Curve25519-XSalsa20-Poly1305, while the Linux/ESXi build includes ESXi-specific behavior such as modifying /etc/vmware/welcome and targeting /vmfs/volumes; researchers said the group typically focuses on encryption rather than data theft or leak-site extortion.
Jul 30
Securelist
New GenieLocker ransomware for Windows, ESXi, and Linux | Securelist
Jul 13
Malware News
Dark Web Profile: Krybit Ransomware - Malware News - Malware Analysis, News and Indicators
Krybit has emerged as a ransomware-as-a-service (RaaS) operation using double extortion, Tor-hosted leak infrastructure, and a likely Babuk-derived payload targeting Windows, Linux, VMware ESXi, and NAS environments. Reporting indicates the malware deletes shadow copies, appends the .KRYBIT extension to encrypted files, and drops a RECOVER-README.txt ransom note. The group has pursued broad, opportunistic victimization across 43 countries, with Germany, Spain, and Brazil among the most affected geographies and professional services, technology, and manufacturing among the most targeted sectors. Public visibility into Krybit increased after rival RaaS operator 0APT breached Krybit’s affiliate panel in April, exposing plaintext credentials, user roles, negotiation data, Tox IDs, and Bitcoin wallets, with leaked records showing about 20 victims in active negotiations and ransom demands ranging from $40,000 to $100,000. Krybit retaliated by compromising and defacing 0APT’s leak site and publishing its operational data, creating a notable ransomware-on-ransomware conflict. Despite the reputational damage and evidence that no confirmed ransom payment had yet been recorded during the leaked period, Krybit continued naming victims through mid-2026 and showed no public signs of shutting down or rebranding.
Jul 13
Socradar
Dark Web Profile: Krybit Ransomware
Jul 12
Lazarusholic Bluesky
Post by @lazarusholic.bsky.social - Bluesky
Jul 12
Lazarusholic Bluesky
Post by @lazarusholic.bsky.social - Bluesky
Sep 12
Mitre Attack Website
