{ "id": "21b3fa55-d0cf-4989-9618-48bf82477b43", "created_at": "2026-04-06T03:36:45.833215Z", "updated_at": "2026-04-10T13:12:11.975844Z", "deleted_at": null, "sha1_hash": "89715104b8820b21a45003b0b04817999b16c754", "title": "Babuk (Malware Family)", "llm_title": "", "authors": "", "file_creation_date": "0001-01-01T00:00:00Z", "file_modification_date": "0001-01-01T00:00:00Z", "file_size": 148404, "plain_text": "Babuk (Malware Family)\r\nBy Fraunhofer FKIE\r\nArchived: 2026-04-06 03:23:31 UTC\r\nBabuk Ransomware is a sophisticated ransomware compiled for several platforms. Windows and ARM for Linux\r\nare the most used compiled versions, but ESX and a 32bit old PE executable were observed over time. as well It\r\nuses an Elliptic Curve Algorithm (Montgomery Algorithm) to build the encryption keys.\r\n2024-11-22 ⋅ Medium (@lcam) ⋅ Luca Mella\r\nHow to target European SME with Ransomware? Through Zyxel!\r\nHellDown Babuk 2024-01-09 ⋅ Avast Decoded ⋅ Threat Research Team\r\nAvast Updates Babuk Ransomware Decryptor in Cooperation with Cisco Talos and Dutch Police\r\nBabuk 2023-12-22 ⋅ PRODAFT ⋅ PRODAFT\r\nSmoke and Mirrors: Understanding The Workings of Wazawaka\r\nConti Monti Babuk Hive LockBit RagnarLocker Trigona 2023-12-13 ⋅ cocomelonc ⋅ cocomelonc\r\nMalware in the wild book\r\nAsyncRAT Babuk BlackCat BlackLotus Carbanak HelloKitty Paradise Stealc WinDealer 2023-06-17 ⋅ Github\r\n(EmissarySpider) ⋅ EmissarySpider\r\nransomware-descendants\r\nBabuk Conti LockBit 2023-06-15 ⋅ Github (cocomelonc) ⋅ cocomelonc\r\nMalware analysis report: Babuk ransomware\r\nBabuk 2023-05-16 ⋅ KrebsOnSecurity ⋅ Brian Krebs\r\nRussian Hacker “Wazawaka” Indicted for Ransomware\r\nBabuk Hive LockBit LockBit Babuk Hive LockBit 2022-12-07 ⋅ Morphisec ⋅ Morphisec Labs\r\nNew Babuk Ransomware Found in Major Attack\r\nBabuk 2022-08-24 ⋅ Trend Micro ⋅ Hitomi Kimura, Ryan Soliven\r\nRansomware Actor Abuses Genshin Impact Anti-Cheat Driver to Kill Antivirus\r\nBabuk 2022-08-24 ⋅ Trend Micro ⋅ Hitomi Kimura, Ryan Soliven\r\nRansomware Actor Abuses Genshin Impact Anti-Cheat Driver to Kill Antivirus (IoCs)\r\nBabuk 2022-06-13 ⋅ Jorge Testa ⋅ Jorge Testa\r\nKilling The Bear - Evil Corp\r\nFAKEUPDATES Babuk Blister DoppelPaymer Dridex Entropy FriedEx Hades Macaw Phoenix Locker\r\nWastedLoader WastedLocker 2022-05-06 ⋅ cyble ⋅ Cyble Research Labs\r\nRebranded Babuk Ransomware In Action: DarkAngels Ransomware Performs Targeted Attack\r\nBabuk 2022-04-20 ⋅ Bleeping Computer ⋅ Bill Toulas\r\nMicrosoft Exchange servers hacked to deploy Hive ransomware\r\nBabuk BlackByte Conti Hive LockFile 2022-03-24 ⋅ SentinelOne ⋅ Antonio Cocomazzi\r\nRansomware Encryption Internals: A Behavioral Characterization\r\nBabuk Babuk BlackMatter 2022-03-23 ⋅ splunk ⋅ Shannon Davis\r\nGone in 52 Seconds…and 42 Minutes: A Comparative Analysis of Ransomware Encryption Speed\r\nhttps://malpedia.caad.fkie.fraunhofer.de/details/win.babuk\r\nPage 1 of 4\n\nAvaddon Babuk BlackMatter Conti DarkSide LockBit Maze Mespinoza REvil Ryuk 2022-02-23 ⋅ splunk ⋅ Shannon\r\nDavis, SURGe\r\nAn Empirically Comparative Analysis of Ransomware Binaries\r\nAvaddon Babuk BlackMatter Conti DarkSide LockBit Maze Mespinoza REvil Ryuk 2022-02-14 ⋅ KrebsOnSecurity ⋅\r\nBrian Krebs\r\nWazawaka Goes Waka Waka\r\nBabuk 2021-11-03 ⋅ Cisco Talos ⋅ Caitlin Huey, Chetan Raghuprasad, Vanja Svajcer\r\nMicrosoft Exchange vulnerabilities exploited once again for ransomware, this time with Babuk\r\nBabuk CHINACHOPPER 2021-10-26 ⋅ Github (vc0RExor) ⋅ Aaron Jornet\r\nBabuk Ransomware\r\nBabuk 2021-10-18 ⋅ McAfee ⋅ Thibault Seret\r\nIs There Really Such a Thing as a Low-Paid Ransomware Operator?\r\nBabuk 2021-10-12 ⋅ CrowdStrike ⋅ CrowdStrike Intelligence Team\r\nECX: Big Game Hunting on the Rise Following a Notable Reduction in Activity\r\nBabuk BlackMatter DarkSide REvil Avaddon Babuk BlackMatter DarkSide LockBit Mailto REvil 2021-10-01 ⋅\r\nZeroFox ⋅ Stephan Simon\r\nBabuk Ransomware Variant Delta Plus Used in Live Attacks After Source Code Leaked\r\nBabuk 2021-09-10 ⋅ S2W LAB Inc. ⋅ S2W TALON\r\nGroove x RAMP : The relation between Groove, Babuk, Payload.bin, RAMP, and BlackMatter\r\nBabuk BlackMatter Babuk BlackMatter 2021-09-09 ⋅ Advanced Intelligence ⋅ Anastasia Sentsova, Yelisey Boguslavskiy\r\nGroove VS Babuk; Groove Ransom Manifesto \u0026 RAMP Underground Platform Secret Inner Workings\r\nBabuk Babuk 2021-09-08 ⋅ Medium s2wlab ⋅ S2W TALON\r\nGroove’s thoughts on Blackmatter, Babuk, and cheese shortages in the Netherlands\r\nBabuk BlackMatter Babuk BlackMatter 2021-09-08 ⋅ McAfee ⋅ John Fokker, Max Kersten, Thibault Seret\r\nHow Groove Gang is Shaking up the Ransomware-as-a-Service Market to Empower Affiliates\r\nBabuk BlackMatter Babuk BlackMatter CTB Locker 2021-09-01 ⋅ Medium s2wlab ⋅ Chaewon Moon, Denise Dasom Kim,\r\nJungyeon Lim, S2W LAB INTELLIGENCE TEAM, Sujin Lim, Yeonghyeon Jeong\r\nBlackMatter x Babuk : Using the same web server for sharing leaked files\r\nBabuk BlackMatter Babuk BlackMatter 2021-08-15 ⋅ Symantec ⋅ Threat Hunter Team\r\nThe Ransomware Threat\r\nBabuk BlackMatter DarkSide Avaddon Babuk BADHATCH BazarBackdoor BlackMatter Clop Cobalt Strike\r\nConti DarkSide DoppelPaymer Egregor Emotet FiveHands FriedEx Hades IcedID LockBit Maze MegaCortex\r\nMimiKatz QakBot RagnarLocker REvil Ryuk TrickBot WastedLocker 2021-08-05 ⋅ KrebsOnSecurity ⋅ Brian Krebs\r\nRansomware Gangs and the Name Game Distraction\r\nDarkSide RansomEXX Babuk Cerber Conti DarkSide DoppelPaymer Egregor FriedEx Gandcrab Hermes Maze\r\nRansomEXX REvil Ryuk Sekhmet 2021-07-28 ⋅ KELA ⋅ Victoria Kivilevich\r\nNew Russian-Speaking Forum – A New Place for RaaS?\r\nBabuk 2021-07-28 ⋅ McAfee ⋅ Noël Keijzer, Thibault Seret\r\nBabuk: Moving to VM and *nix Systems Before Stepping Away\r\nBabuk 2021-07-05 ⋅ Lab52 ⋅ Th3spis\r\nQuick review of Babuk ransomware builder\r\nBabuk 2021-07-04 ⋅ Marco Ramilli's Blog ⋅ Marco Ramilli\r\nhttps://malpedia.caad.fkie.fraunhofer.de/details/win.babuk\r\nPage 2 of 4\n\nBabuk Ransomware: The Builder\r\nBabuk Babuk 2021-07-01 ⋅ BleepingComputer ⋅ Ionut Ilascu\r\nBabuk ransomware is back, uses new version on corporate networks\r\nBabuk 2021-06-30 ⋅ BleepingComputer ⋅ Lawrence Abrams\r\nLeaked Babuk Locker ransomware builder used in new attacks\r\nBabuk 2021-06-27 ⋅ Twitter (@GossiTheDog) ⋅ Kevin Beaumont\r\nTweet on babuk ransomware builder\r\nBabuk 2021-06-27 ⋅ The Record ⋅ Catalin Cimpanu\r\nBuilder for Babuk Locker ransomware leaked online\r\nBabuk 2021-06-10 ⋅ McAfee ⋅ ATR Operational Intelligence Team\r\nAre Virtual Machines the New Gold for Cyber Criminals?\r\nBabuk DarkSide 2021-06-06 ⋅ Bleeping Computer ⋅ Lawrence Abrams\r\nNew Evil Corp ransomware mimics PayloadBin gang to evade US sanctions\r\nBabuk FriedEx PayloadBIN WastedLocker 2021-06-03 ⋅ Medium s2wlab ⋅ Denise Dasom Kim, Hyunmin Suh, Jungyeon Lim,\r\nYH Jeong\r\nW1 Jun | EN | Story of the week: Ransomware on the Darkweb\r\nDarkSide Babuk DarkSide 2021-05-31 ⋅ DataBreaches.net ⋅ Dissent\r\nBabuk re-organizes as Payload Bin, offers its first leak\r\nBabuk HelloKitty 2021-05-25 ⋅ Medium s2wlab ⋅ Denise Dasom Kim, Hyunmin Suh, Jungyeon Lim\r\nW4 May | EN | Story of the week: Ransomware on the Darkweb\r\nBabuk REvil 2021-05-12 ⋅ Kaspersky ⋅ Dmitry Galov, Ivan Kwiatkowski, Leonid Bezvershenko\r\nRansomware world in 2021: who, how and why\r\nBabuk REvil 2021-05-10 ⋅ DarkTracer ⋅ DarkTracer\r\nIntelligence Report on Ransomware Gangs on the DarkWeb: List of victim organizations attacked by ransomware\r\ngangs released on the DarkWeb\r\nRansomEXX Avaddon Babuk Clop Conti Cuba DarkSide DoppelPaymer Egregor Hades LockBit Mailto Maze\r\nMedusaLocker Mespinoza Mount Locker Nefilim Nemty Pay2Key PwndLocker RagnarLocker Ragnarok\r\nRansomEXX REvil Sekhmet SunCrypt ThunderX 2021-05-07 ⋅ Bleeping Computer ⋅ Lawrence Abrams\r\nData leak marketplaces aim to take over the extortion economy\r\nBabuk Maze 2021-04-29 ⋅ ⋅ Sekurak.pl ⋅ Sekurak\r\nUdało nam się zrealizować wywiad z grupą ransomware (Babuk), która zaszyfrowała policję metropolitarną w\r\nWaszyngtonie\r\nBabuk 2021-04-25 ⋅ Vulnerability.ch Blog ⋅ Corsin Camichel\r\nRansomware and Data Leak Site Publication Time Analysis\r\nAvaddon Babuk Clop Conti DarkSide DoppelPaymer Mespinoza Nefilim REvil 2021-02-24 ⋅ McAfee ⋅ Alexandre\r\nMundo, John Fokker, Thibault Seret, Thomas Roccia\r\nTechnical Analysis of Babuk Ransomware\r\nBabuk 2021-02-08 ⋅ Medium Sebdraven ⋅ sebdraven\r\nBabuk is distributed packed\r\nBabuk 2021-02-05 ⋅ Trend Micro ⋅ Don Ovid Ladores, Junestherry Salvador, Llalum Victoria, Monte de Jesus, Nikko Tamana, Raphael\r\nCenteno\r\nNew in Ransomware: Seth-Locker, Babuk Locker, Maoloa, TeslaCrypt, and CobraLocker\r\nhttps://malpedia.caad.fkie.fraunhofer.de/details/win.babuk\r\nPage 3 of 4\n\nBabuk TeslaCrypt 2021-02-02 ⋅ Bleeping Computer ⋅ Lawrence Abrams\r\nBabyk Ransomware won't hit charities, unless they support LGBT, BLM\r\nBabuk 2021-01-26 ⋅ Medium s2wlab ⋅ Hyunmin Suh\r\nW4 Jan | EN | Story of the week: Ransomware on the Darkweb\r\nAvaddon Babuk LockBit 2021-01-16 ⋅ Chuongdong blog ⋅ Chuong Dong\r\nBabuk Ransomware v3\r\nBabuk 2021-01-05 ⋅ Twitter (@Sebdraven) ⋅ Sébastien Larinier\r\nTweet on link between Babuk and Vasa locker\r\nBabuk 2021-01-03 ⋅ Chuongdong blog ⋅ Chuong Dong\r\nBabuk Ransomware\r\nBabuk 2021-01-01 ⋅ Sogeti ⋅ Sogeti\r\nBabuk ransomware\r\nBabuk\r\n[TLP:WHITE] win_babuk_auto (20251219 | Detects win.babuk.)\r\nSource: https://malpedia.caad.fkie.fraunhofer.de/details/win.babuk\r\nhttps://malpedia.caad.fkie.fraunhofer.de/details/win.babuk\r\nPage 4 of 4", "extraction_quality": 1, "language": "EN", "sources": [ "ETDA" ], "origins": [ "web" ], "references": [ "https://malpedia.caad.fkie.fraunhofer.de/details/win.babuk" ], "report_names": [ "win.babuk" ], "threat_actors": [ { "id": "c9617bb6-45c8-495e-9759-2177e61a8e91", "created_at": "2022-10-25T15:50:23.405039Z", "updated_at": "2026-04-10T02:00:05.387643Z", "deleted_at": null, "main_name": "Carbanak", "aliases": [ "Carbanak", "Anunak" ], "source_name": "MITRE:Carbanak", "tools": [ "Carbanak", "Mimikatz", "PsExec", "netsh" ], "source_id": "MITRE", "reports": null }, { "id": "8670f370-1865-4264-9a1b-0dfe7617c329", "created_at": "2022-10-25T16:07:23.69953Z", "updated_at": "2026-04-10T02:00:04.716126Z", "deleted_at": null, "main_name": "Hades", "aliases": [ "Operation TrickyMouse" ], "source_name": "ETDA:Hades", "tools": [ "Brave Prince", "Gold Dragon", "GoldDragon", "Lovexxx", "Olympic Destroyer", "Running RAT", "RunningRAT", "SOURGRAPE", "running_rat" ], "source_id": "ETDA", "reports": null }, { "id": "9de1979b-40fc-44dc-855d-193edda4f3b8", "created_at": "2025-08-07T02:03:24.92723Z", "updated_at": "2026-04-10T02:00:03.755516Z", "deleted_at": null, "main_name": "GOLD LOCUST", "aliases": [ "Anunak", "Carbanak", "Carbon Spider ", "FIN7 ", "Silicon " ], "source_name": "Secureworks:GOLD LOCUST", "tools": [ "Carbanak" ], "source_id": "Secureworks", "reports": null }, { "id": "50068c14-343c-4491-b568-df41dd59551c", "created_at": "2022-10-25T15:50:23.253218Z", "updated_at": "2026-04-10T02:00:05.234464Z", "deleted_at": null, "main_name": "Indrik Spider", "aliases": [ "Indrik Spider", "Evil Corp", "Manatee Tempest", "DEV-0243", "UNC2165" ], "source_name": "MITRE:Indrik Spider", "tools": [ "Mimikatz", "PsExec", "Dridex", "WastedLocker", "BitPaymer", "Cobalt Strike" ], "source_id": "MITRE", "reports": null }, { "id": "b296f34c-c424-41da-98bf-90312a5df8ef", "created_at": "2024-06-19T02:03:08.027585Z", "updated_at": "2026-04-10T02:00:03.621193Z", "deleted_at": null, "main_name": "GOLD DRAKE", "aliases": [ "Evil Corp", "Indrik Spider ", "Manatee Tempest " ], "source_name": "Secureworks:GOLD DRAKE", "tools": [ "BitPaymer", "Cobalt Strike", "Covenant", "Donut", "Dridex", "Hades", "Koadic", "LockBit", "Macaw Locker", "Mimikatz", "Payload.Bin", "Phoenix CryptoLocker", "PowerShell Empire", "PowerSploit", "SocGholish", "WastedLocker" ], "source_id": "Secureworks", "reports": null }, { "id": "4e453d66-9ecd-47d9-b63a-32fa5450f071", "created_at": "2024-06-19T02:03:08.077075Z", "updated_at": "2026-04-10T02:00:03.830523Z", "deleted_at": null, "main_name": "GOLD LOTUS", "aliases": [ "BlackByte", "Hecamede " ], "source_name": "Secureworks:GOLD LOTUS", "tools": [ "BlackByte", "Cobalt Strike", "ExByte", "Mega", "RDP", "SoftPerfect Network Scanner" ], "source_id": "Secureworks", "reports": null }, { "id": "bb8702c5-52ac-4359-8409-998a7cc3eeaf", "created_at": "2023-01-06T13:46:38.405479Z", "updated_at": "2026-04-10T02:00:02.961112Z", "deleted_at": null, "main_name": "FIN7", "aliases": [ "ATK32", "G0046", "G0008", "Sangria Tempest", "ELBRUS", "GOLD NIAGARA", "Coreid", "Carbanak", "Carbon Spider", "JokerStash", "CARBON SPIDER" ], "source_name": "MISPGALAXY:FIN7", "tools": [], "source_id": "MISPGALAXY", "reports": null }, { "id": "ed3810b7-141a-4ed0-8a01-6a972b80458d", "created_at": "2022-10-25T16:07:23.443259Z", "updated_at": "2026-04-10T02:00:04.602946Z", "deleted_at": null, "main_name": "Carbanak", "aliases": [ "Anunak", "Carbanak", "Carbon Spider", "ELBRUS", "G0008", "Gold Waterfall", "Sangria Tempest" ], "source_name": "ETDA:Carbanak", "tools": [ "AVE_MARIA", "Agentemis", "AmmyyRAT", "Antak", "Anunak", "Ave Maria", "AveMariaRAT", "BABYMETAL", "BIRDDOG", "Backdoor Batel", "Batel", "Bateleur", "BlackMatter", "Boostwrite", "Cain \u0026 Abel", "Carbanak", "Cl0p", "Cobalt Strike", "CobaltStrike", "DNSMessenger", "DNSRat", "DNSbot", "DRIFTPIN", "DarkSide", "FOXGRABBER", "FlawedAmmyy", "HALFBAKED", "JS Flash", "KLRD", "MBR Eraser", "Mimikatz", "Nadrac", "Odinaff", "POWERPIPE", "POWERSOURCE", "PsExec", "SQLRAT", "Sekur", "Sekur RAT", "SocksBot", "SoftPerfect Network Scanner", "Spy.Agent.ORM", "TEXTMATE", "TeamViewer", "TiniMet", "TinyMet", "Toshliph", "VB Flash", "WARPRISM", "avemaria", "cobeacon" ], "source_id": "ETDA", "reports": null }, { "id": "9806f226-935f-48eb-b138-6616c9bb9d69", "created_at": "2022-10-25T16:07:23.73153Z", "updated_at": "2026-04-10T02:00:04.729977Z", "deleted_at": null, "main_name": "Indrik Spider", "aliases": [ "Blue Lelantos", "DEV-0243", "Evil Corp", "G0119", "Gold Drake", "Gold Winter", "Manatee Tempest", "Mustard Tempest", "UNC2165" ], "source_name": "ETDA:Indrik Spider", "tools": [ "Advanced Port Scanner", "Agentemis", "Babuk", "Babuk Locker", "Babyk", "BitPaymer", "Bugat", "Bugat v5", "Cobalt Strike", "CobaltStrike", "Cridex", "Dridex", "EmPyre", "EmpireProject", "FAKEUPDATES", "FakeUpdate", "Feodo", "FriedEx", "Hades", "IEncrypt", "LINK_MSIEXEC", "MEGAsync", "Macaw Locker", "Metasploit", "Mimikatz", "PayloadBIN", "Phoenix Locker", "PowerShell Empire", "PowerSploit", "PsExec", "QNAP-Worm", "Raspberry Robin", "RaspberryRobin", "SocGholish", "Vasa Locker", "WastedLoader", "WastedLocker", "cobeacon", "wp_encrypt" ], "source_id": "ETDA", "reports": null }, { "id": "f4f16213-7a22-4527-aecb-b964c64c2c46", "created_at": "2024-06-19T02:03:08.090932Z", "updated_at": "2026-04-10T02:00:03.6289Z", "deleted_at": null, "main_name": "GOLD NIAGARA", "aliases": [ "Calcium ", "Carbanak", "Carbon Spider ", "FIN7 ", "Navigator ", "Sangria Tempest ", "TelePort Crew " ], "source_name": "Secureworks:GOLD NIAGARA", "tools": [ "Bateleur", "Carbanak", "Cobalt Strike", "DICELOADER", "DRIFTPIN", "GGLDR", "GRIFFON", "JSSLoader", "Meterpreter", "OFFTRACK", "PILLOWMINT", "POWERTRASH", "SUPERSOFT", "TAKEOUT", "TinyMet" ], "source_id": "Secureworks", "reports": null }, { "id": "4e7fd07d-fcc5-459b-b678-45a7d9cda751", "created_at": "2025-04-23T02:00:55.174827Z", "updated_at": "2026-04-10T02:00:05.353712Z", "deleted_at": null, "main_name": "BlackByte", "aliases": [ "BlackByte", "Hecamede" ], "source_name": "MITRE:BlackByte", "tools": [ "AdFind", "BlackByte Ransomware", "Exbyte", "Arp", "BlackByte 2.0 Ransomware", "PsExec", "Cobalt Strike", "Mimikatz" ], "source_id": "MITRE", "reports": null }, { "id": "6c4f98b3-fe14-42d6-beaa-866395455e52", "created_at": "2023-01-06T13:46:39.169554Z", "updated_at": "2026-04-10T02:00:03.23458Z", "deleted_at": null, "main_name": "Evil Corp", "aliases": [ "GOLD DRAKE" ], "source_name": "MISPGALAXY:Evil Corp", "tools": [], "source_id": "MISPGALAXY", "reports": null } ], "ts_created_at": 1775446605, "ts_updated_at": 1775826731, "ts_creation_date": 0, "ts_modification_date": 0, "files": { "pdf": "https://archive.orkl.eu/89715104b8820b21a45003b0b04817999b16c754.pdf", "text": "https://archive.orkl.eu/89715104b8820b21a45003b0b04817999b16c754.txt", "img": "https://archive.orkl.eu/89715104b8820b21a45003b0b04817999b16c754.jpg" } }