{
	"id": "9c1ba95b-ce2c-4515-a5cd-876490c26daa",
	"created_at": "2026-04-06T00:17:08.054297Z",
	"updated_at": "2026-04-10T03:20:23.381025Z",
	"deleted_at": null,
	"sha1_hash": "5317510b8bee6d4749e4f6671a6d3863b1071125",
	"title": "Babuk ransomware is back, uses new version on corporate networks",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 2568544,
	"plain_text": "Babuk ransomware is back, uses new version on corporate networks\r\nBy Ionut Ilascu\r\nPublished: 2021-07-01 · Archived: 2026-04-05 18:50:37 UTC\r\nAfter announcing their exit from the ransomware business in favor of data theft extortion, the Babuk gang appears to have\r\nslipped back into their old habit of encrypting corporate networks.\r\nThe criminals are currently using a new version of their file-encrypting malware and have moved the operation to a new leak\r\nsite that lists a handful of victims.\r\nGang's still in the game\r\nThe Babuk ransomware group became known at the beginning of the year but the gang says that their attacks had started in\r\nmid-October 2020, targeting companies across the world and demanding ransoms typically between $60,000 and $85,000 in\r\nbitcoin cryptocurrency. In some cases, victims were asked hundreds of thousands for data decryption.\r\nhttps://www.bleepingcomputer.com/news/security/babuk-ransomware-is-back-uses-new-version-on-corporate-networks/\r\nPage 1 of 4\n\n0:00\r\nhttps://www.bleepingcomputer.com/news/security/babuk-ransomware-is-back-uses-new-version-on-corporate-networks/\r\nPage 2 of 4\n\nVisit Advertiser websiteGO TO PAGE\r\nOne of their most publicized victims is the Washinton DC's Metropolitan Police Department (MPD). This attack likely\r\npushed the threat actor into announcing its retirement from the ransomware business only to adopt another extortion model\r\nthat did not include encryption.\r\nThe gang also announced plans to release their malware so that other cybercriminals could start a ransomware-as-a-service\r\noperation. The threat actor kept its promise and published its builder, a tool that generates customized ransomware.\r\nSecurity researcher Kevin Beaumont found it on VirusTotal and shared the information to help the infosec community with\r\ndetection and decryption.\r\nAfter shutting down in April, the gang took the name PayLoad Bin, but their leak site shows little activity. Instead, a new\r\nleak site emerged on the dark web carrying the Babuk ransomware markings.\r\nThe site lists fewer than five victims that refused to pay the ransom and that they have been attacked with a second version\r\nof the malware.\r\nIt appears that Babuk has not given up the encryption-based extortion game. They released only the old version of their\r\nmalware and created a new one to get back into the ransomware business.\r\nThe gang made this clear in a comment to our article about a rush of ransomware attacks that used the leaked Babuk builder\r\nand demanded .006 bitcoins (currently about $200) - clearly showing that it’s not the original group using it.\r\nIt appears that the Babuk gang is not ready to give up the file-encryption activity and will continue to focus on corporate\r\nnetworks for larger payments.\r\nIt is unclear what drove the group to return to their old practices but given how empty the PayLoad Bin leak site is, one can\r\nspeculate that data theft extortion did not go too well.\r\nAlso, it remains unknown at the moment if the new Babuk operation has behind it the same members that attacked\r\nWashinton DC's Metropolitan Police Department or this incident produced a split.\r\nhttps://www.bleepingcomputer.com/news/security/babuk-ransomware-is-back-uses-new-version-on-corporate-networks/\r\nPage 3 of 4\n\nAutomated Pentesting Covers Only 1 of 6 Surfaces.\r\nAutomated pentesting proves the path exists. BAS proves whether your controls stop it. Most teams run one without the\r\nother.\r\nThis whitepaper maps six validation surfaces, shows where coverage ends, and provides practitioners with three diagnostic\r\nquestions for any tool evaluation.\r\nSource: https://www.bleepingcomputer.com/news/security/babuk-ransomware-is-back-uses-new-version-on-corporate-networks/\r\nhttps://www.bleepingcomputer.com/news/security/babuk-ransomware-is-back-uses-new-version-on-corporate-networks/\r\nPage 4 of 4",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"Malpedia",
		"ETDA"
	],
	"references": [
		"https://www.bleepingcomputer.com/news/security/babuk-ransomware-is-back-uses-new-version-on-corporate-networks/"
	],
	"report_names": [
		"babuk-ransomware-is-back-uses-new-version-on-corporate-networks"
	],
	"threat_actors": [],
	"ts_created_at": 1775434628,
	"ts_updated_at": 1775791223,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/5317510b8bee6d4749e4f6671a6d3863b1071125.pdf",
		"text": "https://archive.orkl.eu/5317510b8bee6d4749e4f6671a6d3863b1071125.txt",
		"img": "https://archive.orkl.eu/5317510b8bee6d4749e4f6671a6d3863b1071125.jpg"
	}
}