Netskope Threat Labs

Babuk

ATP Sandbox Adv. HeuristicsAVNetskope IPS

Description

Babuk is a ransomware operation that emerged in 2021 and targeted both corporate networks and smaller victims through compromised remote access services. It exfiltrates data before encryption and threatens publication on a leak site, and it supports Windows systems along with network attached storage devices and VMware ESXi servers. Its source code leaked later in 2021, which allowed cyberattackers to reuse it in new and modified families.

Stats

First seen
March 2022
Last seen
October 2026

Also known as

Babyk

MITRE ATT&CK techniques

14 techniques across 5 tactics.

TA0002 Execution

TA0005 Stealth

  • T1027Obfuscated Files or Information
  • T1140Deobfuscate/Decode Files or Information

TA0007 Discovery

  • T1007System Service Discovery
  • T1049System Network Connections Discovery
  • T1057Process Discovery
  • T1083File and Directory Discovery
  • T1135Network Share Discovery
  • T1680Local Storage Discovery

TA0040 Impact

  • T1486Data Encrypted for Impact
  • T1489Service Stop
  • T1490Inhibit System Recovery

TA0112 Defense Impairment

  • T1685Disable or Modify Tools

Alert name variants

Alert Name
Gen:Variant.Ransom.Babuk.114
Gen:Variant.Ransom.Babuk.141
Gen:Variant.Ransom.Babuk.157
Gen:Variant.Ransom.Babuk.165
Gen:Variant.Ransom.Babuk.172
Gen:Variant.Ransom.Babuk.44
Gen:Variant.Ransom.Babuk.69
Gen:Variant.Ransom.Babuk.9
Gen:Variant.Ransomware.Linux.Babuk.1
Gen:Variant.Trojan.Linux.Babuk.1

Related IPS Signatures

Signature Name
MALWARE-CNC Win.Ransomware.Babuk encrypted file exfiltration attempt
MALWARE-OTHER Win.Ransomware.Babuk variant download attempt
MALWARE-OTHER Win.Ransomware.Babuk variant transfer attempt

Related blogs

Related families

CubaClopQilinContiEmbargo

References