Ransomware group profile · #213 by claimed victims

Babuk ransomware

Babuk Ransomware is a sophisticated ransomware compiled for several platforms. Windows and ARM for Linux are the most used compiled versions, but ESX and a 32bit old PE executable were observed over time. as well It uses an Elliptic Curve Algorithm (Montgomery Algorithm) to build the encryption keys.

Active First seen Oct 2020

8Victims claimed on leak sites

0Victims in the last 30 days

0Victims in the last 90 days

3Countries hit

0Leak-site URLs tracked

31 Jul 2023Latest claim recorded

Victimology

Who Babuk claims to have breached, from 8 leak-site posts recorded by VULONE.

Claims per month last 12 months

Top sectors

Professional Services2

Retail & E-Commerce2

Transportation1

Hospitality1

Healthcare1

Government & Defense1

Top countries

United States3

United Kingdom1

France1

Latest claimed victims 8 most recent

Victim	Sector	Country	Claimed
4murs.com 4murs.com	Retail & E-Commerce	FR	31 Jul 2023
Arabian Computer Supplies co. arabian computer supplies co.	Professional Services	—	31 Jul 2023
spsr-law.com spsr-law.com	Professional Services	—	31 Jul 2023
E.A. Gibson Shipbrokers e.a. gibson shipbrokers	Transportation	—	31 Jul 2023
BridgeMill Athletic Club bridgemillathleticclub.com	Retail & E-Commerce	US	31 Jul 2023
Washington DC Metropolitan Police Department	Government & Defense	US	1 Apr 2021
Houston Rockets NBA Team	Hospitality	US	1 Apr 2021
Serco serco.com	Healthcare	GB	25 Oct 2020

All 8 Babuk victims, searchable

Full victim list with claim posts, domains, timing and exports, plus the negotiation chats and leak-site screenshots VULONE archives for this crew.

Start free Sign in

Tactics, techniques and procedures

ATT&CK technique mapping for Babuk is in progress. Victimology, infrastructure status and leak-site tracking are live above.

Indicators, detections and the full playbook

Hashes, C2 addresses, onion services, Sigma and YARA detections per technique, and the negotiation transcripts are available to signed-in analysts.

See full IOCs

Frequently asked

Is Babuk ransomware still active?

Babuk is tracked as active. The most recent leak-site claim VULONE recorded is dated 31 July 2023.

How many victims has Babuk claimed?

VULONE has recorded 8 leak-site victim claims attributed to Babuk since October 2020, across 3 countries and 6 sectors.

Which industries does Babuk target?

The sectors most often named on the Babuk leak site are Professional Services, Retail & E-Commerce, Transportation.

Which countries are most affected by Babuk?

Most Babuk victims recorded by VULONE are located in United States, United Kingdom, France.

Where does VULONE get Babuk victim data?

Claims are collected continuously from the group's own leak sites and cross-checked with ransomware.live and RansomLook. A claim is the group's assertion, not a confirmed breach.

Other ransomware groups

Victim claims are collected from leak sites and enrichment partners (ransomware.live, RansomLook) and represent the group's own assertions, not confirmed breaches. Profile last updated 16 September 2026. Questions or corrections: [email protected].