Ransomware group profile · #38 by claimed victims

Babuk2 ransomwarealso Satanlock

Babuk Locker 2.0, also known as Bjorka or SkyWave, after failing to make any profit from selling public databases on forums, decided to impersonate Babuk Ransomware group. He launched a blog where he claimed multiple public breaches from BreachForums as ransomware attacks

Active First seen Jan 2025

180Victims claimed on leak sites

0Victims in the last 30 days

0Victims in the last 90 days

52Countries hit

0Leak-site URLs tracked

23 Apr 2025Latest claim recorded

Victimology

Who Babuk2 claims to have breached, from 180 leak-site posts recorded by VULONE.

Claims per month last 12 months

Top sectors

Government & Defense46

Technology41

Healthcare15

Professional Services13

Manufacturing13

Financial Services11

Retail & E-Commerce9

Energy & Utilities7

Top countries

United States34

Brazil15

India10

Indonesia9

China7

Iraq5

Italy5

Thailand5

Latest claimed victims 12 most recent

Victim	Sector	Country	Claimed
tecnologias.mspz2.gob.ec tecnologias.mspz2.gob.ec	Government & Defense	EC	23 Apr 2025
turkish defense military	Government & Defense	TR	4 Apr 2025
rheinmetall.com (Rheinmetall Defence) rheinmetall.com	Manufacturing	DE	4 Apr 2025
gangotreehomes.com (RealEstate) gangotreehomes.com	Retail & E-Commerce	IN	3 Apr 2025
Secret plans of Indian army	Government & Defense	—	3 Apr 2025
Bangladesh Armed Forces (BangLadesh Army)	Government & Defense	BD	3 Apr 2025
Saudi Arabian military and government internal center	Government & Defense	SA	3 Apr 2025
Hellenic Airforce	Government & Defense	GR	3 Apr 2025
ezbuy.sg (Singapore Shopping) ezbuy.sg	Retail & E-Commerce	SG	3 Apr 2025
Iran gas service system	Energy & Utilities	IR	3 Apr 2025
kfar hatta medical center - Lebanon	Healthcare	LB	3 Apr 2025
Polizia italia mail access poliziadistato.it	Government & Defense	IT	3 Apr 2025

All 180 Babuk2 victims, searchable

Full victim list with claim posts, domains, timing and exports, plus the negotiation chats and leak-site screenshots VULONE archives for this crew.

Start free Sign in

Tactics, techniques and procedures

ATT&CK technique mapping for Babuk2 is in progress. Victimology, infrastructure status and leak-site tracking are live above.

Indicators, detections and the full playbook

Hashes, C2 addresses, onion services, Sigma and YARA detections per technique, and the negotiation transcripts are available to signed-in analysts.

See full IOCs

Frequently asked

Is Babuk2 ransomware still active?

Babuk2 is tracked as active. The most recent leak-site claim VULONE recorded is dated 23 April 2025.

How many victims has Babuk2 claimed?

VULONE has recorded 180 leak-site victim claims attributed to Babuk2 since January 2025, across 52 countries and 14 sectors.

Which industries does Babuk2 target?

The sectors most often named on the Babuk2 leak site are Government & Defense, Technology, Healthcare.

Which countries are most affected by Babuk2?

Most Babuk2 victims recorded by VULONE are located in United States, Brazil, India.

Where does VULONE get Babuk2 victim data?

Claims are collected continuously from the group's own leak sites and cross-checked with ransomware.live and RansomLook. A claim is the group's assertion, not a confirmed breach.

Other ransomware groups

Victim claims are collected from leak sites and enrichment partners (ransomware.live, RansomLook) and represent the group's own assertions, not confirmed breaches. Profile last updated 16 September 2026. Questions or corrections: [email protected].