{
	"id": "b083d872-da40-4f5a-b3d7-ac712c96366d",
	"created_at": "2026-04-06T00:12:42.266214Z",
	"updated_at": "2026-04-10T03:21:59.420713Z",
	"deleted_at": null,
	"sha1_hash": "049dcd2cba06e60ef766999b0ff70695d943799f",
	"title": "Leaked Babuk Locker ransomware builder used in new attacks",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 2761599,
	"plain_text": "Leaked Babuk Locker ransomware builder used in new attacks\r\nBy Lawrence Abrams\r\nPublished: 2021-06-30 · Archived: 2026-04-05 17:01:10 UTC\r\nA leaked tool used by the Babuk Locker operation to create custom ransomware executables is now being used by another\r\nthreat actor in a very active campaign targeting victims worldwide.\r\nBabuk Locker was a ransomware operation that launched at the beginning of 2021 when it began targeting corporate victims\r\nand stealing their data in double-extortion attacks.\r\nAfter performing an attack on Washinton DC's Metropolitan Police Department (MPD) and feeling the pressure from law\r\nenforcement, the ransomware gang shut down in April and switched to a non-encrypting data extortion model under the\r\nname PayLoad Bin.\r\nhttps://www.bleepingcomputer.com/news/security/leaked-babuk-locker-ransomware-builder-used-in-new-attacks/\r\nPage 1 of 6\n\n0:00\r\nhttps://www.bleepingcomputer.com/news/security/leaked-babuk-locker-ransomware-builder-used-in-new-attacks/\r\nPage 2 of 6\n\nVisit Advertiser websiteGO TO PAGE\r\nBabuk Locker builder leaked\r\nLast week, security researcher Kevin Beaumont discovered that someone uploaded the Babuk operation's ransomware\r\nbuilder to VirusTotal.\r\nWhen BleepingComputer tested the builder, it was simplistic to generate a customized ransomware.\r\nAll a threat actor has to do is modify the enclosed ransom note to include their own contact info, and then run the build\r\nexecutable to create customized ransomware encryptors and decryptors that target Windows, VMware ESXi, Network\r\nAttached Storage (NAS) x86, and NAS ARM devices.\r\nUsing the builder to create a customized Babuk ransomware\r\nSource: BleepingComputer.com\r\nBabuk builder used to launch new attacks\r\nSoon after the builder was leaked online, a threat actor began using it to launch a very active ransomware campaign.\r\nStarting on Tuesday, a victim reported on Reddit that they were hit by ransomware calling itself 'Babuk Locker.'\r\nSecurity researcher MalwareHunterTeam also told BleepingComputer that ID Ransomware received a sharp spike in Babuk\r\nLocker submissions starting on June 29th. These victims are from all over the world, and the submitted ransom notes all\r\ncontained the email address of the threat actor.\r\nhttps://www.bleepingcomputer.com/news/security/leaked-babuk-locker-ransomware-builder-used-in-new-attacks/\r\nPage 3 of 6\n\nA sharp spike in Babuk Ransomware submissions to ID Ransomware\r\nLike the original operation, this ransomware attack adds the .babyk extension to encrypted file names and drops a ransom\r\nnote named How To Restore Your Files.txt.\r\nFiles encrypted by Babuk Locker\r\nSource: BleepingComputer\r\nCompared to the original Babuk Ransomware operation that demanded hundreds of thousands, if not millions, of dollars to\r\nrecover their files, this new threat actor is only asking for .006 bitcoins or approximately $210 from their victims.\r\nhttps://www.bleepingcomputer.com/news/security/leaked-babuk-locker-ransomware-builder-used-in-new-attacks/\r\nPage 4 of 6\n\nRansom note from new Babuk ransomware attack\r\nSource: BleepingComputer\r\nThe new threat actors also misspelled Babuk by adding a 'C' to 'Babuck Locker' in the ransom note.\r\nAnother noticeable change is that the original Babuk Locker operation utilized a dedicated Tor payment site used to\r\nnegotiate with victims. However, the new attacks are using email to communicate with victims through a\r\nbabukransom@tutanota.com email address.\r\nIt is unclear how the ransomware is being distributed, but we have created a dedicated Babuck Locker support topic that\r\nvictims can use to share more information about the attack.\r\nIf anyone pays the ransom demand for this new ransomware campaign, please let us know as we would like to ask you some\r\nprivate questions.\r\nhttps://www.bleepingcomputer.com/news/security/leaked-babuk-locker-ransomware-builder-used-in-new-attacks/\r\nPage 5 of 6\n\nAutomated Pentesting Covers Only 1 of 6 Surfaces.\r\nAutomated pentesting proves the path exists. BAS proves whether your controls stop it. Most teams run one without the\r\nother.\r\nThis whitepaper maps six validation surfaces, shows where coverage ends, and provides practitioners with three diagnostic\r\nquestions for any tool evaluation.\r\nSource: https://www.bleepingcomputer.com/news/security/leaked-babuk-locker-ransomware-builder-used-in-new-attacks/\r\nhttps://www.bleepingcomputer.com/news/security/leaked-babuk-locker-ransomware-builder-used-in-new-attacks/\r\nPage 6 of 6",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"Malpedia",
		"ETDA"
	],
	"references": [
		"https://www.bleepingcomputer.com/news/security/leaked-babuk-locker-ransomware-builder-used-in-new-attacks/"
	],
	"report_names": [
		"leaked-babuk-locker-ransomware-builder-used-in-new-attacks"
	],
	"threat_actors": [],
	"ts_created_at": 1775434362,
	"ts_updated_at": 1775791319,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/049dcd2cba06e60ef766999b0ff70695d943799f.pdf",
		"text": "https://archive.orkl.eu/049dcd2cba06e60ef766999b0ff70695d943799f.txt",
		"img": "https://archive.orkl.eu/049dcd2cba06e60ef766999b0ff70695d943799f.jpg"
	}
}