Hacker Buba

Profile narrative

The threat actor known as Hacker Buba, also referred to simply as Buba, has been linked to cyber incidents targeting financial institutions in the United Arab Emirates. Open source reporting indicates the actor operates from Indonesia, as evidenced by Indonesian language posts attributed to the account. The alias appears in multiple reports describing extortion attempts and data leaks involving UAE banks. No additional aliases or affiliations have been publicly disclosed beyond those names.

The actor’s observed activity focuses on the banking sector, specifically UAE‑based financial institutions. In a November 2015 intrusion, Hacker Buba exfiltrated confidential client data and demanded a three million dollar ransom in Bitcoin, threatening to publish the information on Twitter unless paid. When the ransom was not met, the actor released account statements of government entities, businesses and individuals, directly messaging victims to pressure payment. A later incident in December 2015 involved the re‑posting of previously stolen data, which researchers assessed was likely intended to gain notoriety rather than reflect a new breach. These actions show a dual objective of financial extortion and seeking public attention through data disclosure.

The actor primarily uses social media, namely Twitter, to distribute stolen documents and to communicate ransom demands. Prior to leaking data, Hacker Buba sent warning text messages and emails to bank customers, asserting control over their accounts and urging direct payment. The ransom is requested in Bitcoin, reflecting a preference for decentralized digital currency. To hinder attribution, the actor employs international digital obfuscation tactics, such as posting from a Twitter location that points to Hungary while using Indonesian language content and sending SMS messages via a United Kingdom‑based phone number. In one instance, the actor used a stolen photograph of a bank employee to lend credibility to the threats. No specific malware families or custom tooling have been described in the public reports.

The November 2015 ransom campaign against a Sharjah bank represents the actor’s most detailed extortion operation, involving repeated Twitter leaks and direct victim outreach. The subsequent December 2015 redistribution of older breach data illustrates a follow‑on effort to maintain visibility after the initial extortion attempt failed. During the Twitter exchanges, Hacker Buba claimed access to the bank’s full database and backup files and offered a percentage of the ransom to collaborators, while also stating intent to target additional banks in the United Arab Emirates, Qatar and Saudi Arabia. These publicly reported episodes constitute the known operational footprint of the threat actor.

Incidents

Attributed incidents are available to members.

Sources

Sources available to members: 1 source.