{
	"id": "abb4c0b6-7c30-4ed5-a407-a9fa66457d3b",
	"created_at": "2026-04-06T00:18:27.407264Z",
	"updated_at": "2026-04-10T03:21:46.985594Z",
	"deleted_at": null,
	"sha1_hash": "3911e120ef8cadf648ecba6d495843241f590607",
	"title": "BlackMatter x Babuk : Using the same web server for sharing leaked files",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 690751,
	"plain_text": "BlackMatter x Babuk : Using the same web server for sharing\r\nleaked files\r\nBy S2W\r\nPublished: 2021-09-01 · Archived: 2026-04-05 15:58:48 UTC\r\nWith contribution from Hotsauce (\r\n, , , , )| S2W TALON\r\nAbstract\r\nBlackMatter published the leaked files and documents related to infected victim companies started on August 1,\r\n2021. They published the leaked data of 7 infected victim companies on their leak site.\r\nPress enter or click to view image in full size\r\nBlackMatter using file hosting services\r\nBlackMatter is using the file hosting services on their leak site and they are not uploaded the leaked data on their\r\nown web server. We checked BlackMatter used Mega Cloud, PrivatLab, DropmeFiles, 2 Tor Web Servers on their\r\nleak site.\r\nBlackMatter x Babuk : Using the same web server for sharing leaked files\r\nhttps://medium.com/s2wlab/blackmatter-x-babuk-using-the-same-web-server-for-sharing-leaked-files-d01c20a74751\r\nPage 1 of 4\n\nThe interesting point is a Tor Web Server(http://flhnknbdg7****.onion) is the same as Babuk’s file server when\r\nthey share the leaked files with users.\r\nPress enter or click to view image in full size\r\nThe leaked data uploaded to the same web server by BlackMatter and Babuk\r\nIn the file server of BlackMatter, we checked the leaked data uploaded by Babuk and BlackMatter as below:\r\nPress enter or click to view image in full size\r\nhttps://medium.com/s2wlab/blackmatter-x-babuk-using-the-same-web-server-for-sharing-leaked-files-d01c20a74751\r\nPage 2 of 4\n\nThe string was changed on August 28, 2021\r\n(Previous title) 2021–05–31 BABUK STRONAGE SERVER, Joe Biden Caprophile\r\nGet S2W’s stories in your inbox\r\nJoin Medium for free to get updates from this writer.\r\nRemember me for faster sign in\r\n(Current title) 2021–08–28 GROVE STRONAGE SERVER\r\nPress enter or click to view image in full size\r\nhttps://medium.com/s2wlab/blackmatter-x-babuk-using-the-same-web-server-for-sharing-leaked-files-d01c20a74751\r\nPage 3 of 4\n\nWhen Babuk uses this web server for sharing the leaked files, if we enter the root directory of the web server, we\r\ncan see the string of BABUK STRONAGE SERVER, Joe Biden Caprophile. But now, the title of the web server\r\nchanged the string to GROVE STRONAGE SERVER.\r\nConclusion\r\nIn this post, we mentioned the fact of BlackMatter and Babuk using the same web server for sharing the\r\nleaked files.\r\nWe could not find any pieces of the evidence whether they are in the same group.\r\nThey may have accidentally rented the same web server, or we need to keep monitoring their activities to\r\ntrack the relation between BlackMatter and Babuk.\r\nSource: https://medium.com/s2wlab/blackmatter-x-babuk-using-the-same-web-server-for-sharing-leaked-files-d01c20a74751\r\nhttps://medium.com/s2wlab/blackmatter-x-babuk-using-the-same-web-server-for-sharing-leaked-files-d01c20a74751\r\nPage 4 of 4",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"Malpedia",
		"ETDA"
	],
	"references": [
		"https://medium.com/s2wlab/blackmatter-x-babuk-using-the-same-web-server-for-sharing-leaked-files-d01c20a74751"
	],
	"report_names": [
		"blackmatter-x-babuk-using-the-same-web-server-for-sharing-leaked-files-d01c20a74751"
	],
	"threat_actors": [],
	"ts_created_at": 1775434707,
	"ts_updated_at": 1775791306,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/3911e120ef8cadf648ecba6d495843241f590607.pdf",
		"text": "https://archive.orkl.eu/3911e120ef8cadf648ecba6d495843241f590607.txt",
		"img": "https://archive.orkl.eu/3911e120ef8cadf648ecba6d495843241f590607.jpg"
	}
}