Babuk
Attribution profile
- Type
- Crime Syndicate
- Location
- Russia
- Known incidents
- 10 incidents
- Sources
- 9 sources
- First seen
- 2021-01-15
- Last seen
- 2021-05-10
- Updated
- 2026-10-14 02:15
- Aliases
- 4 aliases
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
Babuk, also known as Babuk Locker and initially Vasa Locker, is a ransomware group first observed in early 2021 and believed to operate from Russia. The group describes itself as a non‑malicious entity seeking to expose security flaws, yet it conducts extortion by encrypting files and threatening to leak stolen data unless a ransom is paid. It primarily targets transportation, healthcare, plastic surgery, electronics, and agricultural sectors, with observed activity concentrated in Germany, Hong Kong, Sweden, and the United States, while also hitting victims in Japan, Italy, Spain, the United Kingdom and the United States across incidents such as the VPN‑zero‑day compromise of a Japanese power‑tool manufacturer, the seven‑month infiltration and 10 GB exfiltration from an Italian pharmaceutical firm, the leak of 250 GB of data from the Washington D.C. Metropolitan Police Department, the $6 million Bitcoin ransom demand against a Spanish telecommunications provider affecting three million users, and the exposure of >700 GB of schematics and purchase orders from a U.S. military contractor. Tactics include phishing, exploitation of unpatched CVEs and weak RDP or VPN credentials, attempts to disable security and backup services, and use of the ChaCha8/HC‑128 encryption algorithm with Elliptic‑curve Diffie‑Hellman key protection. No public attribution to a state sponsor or criminal alliance has been presented.
Incidents
Attributed incidents are available to members.
10 incidentsSources
Sources available to members: 9 sources.