Babuk Locker 2.0, also known as Bjorka or SkyWave, after failing to make any profit from selling public databases on forums, decided to impersonate Babuk Ransomware group. He launched a blog where he claimed multiple public breaches from BreachForums as ransomware attacks
Genera un perfil del actor con IA (defensivo) cuando lo pidas.
Este grupo no tiene TTPs curadas. Puedes generar un mapeo MITRE ESTIMADO por IA (no confirmado) a partir de su descripción/notas, solo cuando lo pidas.
Firma de detección defensiva para este grupo (úsala en tu EDR/SIEM). Fuente: ransomware.live.
/*
babuk2 ransomware
*/
rule babuk2_Ransomnote
{
meta:
author = "ransomware.live"
family = "ransomware.babuk2"
description = "Detects babuk2 ransomware ransom note or artifact"
date = "2026-05-04"
severity = 7
score = 70
strings:
$name1 = "babuk2" ascii nocase
$name2 = "BABUK2" ascii
$onion = "babuk2.onion" ascii nocase
condition:
any of them
}
tecnologias.mspz2.gob.ec
uniproof.com.br
| Organización | País | Sector | Grupo | Descubierta |
|---|---|---|---|---|
| tecnologias.mspz2.gob.ec | EC | Public Sector | — | 23 abr 2025 |
| uniproof.com.br | BR | Not Found | — | 1 abr 2025 |
| brune.com.br - Group MC (conglomerate) | BR | Manufacturing | — | 29 mar 2025 |
| icvc.co - Instituto Cardiovascular del Cesar | CO | Healthcare | — | 29 mar 2025 |
| www.gob.ve | VE | Public Sector | — | 19 mar 2025 |
| Municipal taxation Secretariat Access - Brazil Goverment | BR | Public Sector | — | 19 mar 2025 |
| movistar.com.pe | PE | Telecommunication | — | 14 mar 2025 |
| nuclep.gov.br. Nuclep Brazil | BR | Public Sector | — | 14 mar 2025 |
| fnde.gov.br brazilian government | BR | Public Sector | — | 11 mar 2025 |
| Mandarin.com.br | BR | Consumer Services | — | 10 mar 2025 |
| copral.com.br | BR | Manufacturing | — | 27 ene 2025 |
| viacaojacarei.com.br | BR | Transportation/Logistics | — | 27 ene 2025 |
| gelco-s-a.com.br | BR | Manufacturing | — | 27 ene 2025 |
| Kurosu & Co.SA - kurosu.com.py | PY | Agriculture and Food Production | — | 27 ene 2025 |
| zapopan.gob.mx | MX | Public Sector | — | 27 ene 2025 |
| nhbg.com.co | CO | Not Found | — | 27 ene 2025 |
| sincorpe.org.br | BR | Not Found | — | 27 ene 2025 |
| lamundialdeseguros.com | CO | Financial Services | — | 27 ene 2025 |
| www.shootinghouse.com.br | BR | Not Found | — | 27 ene 2025 |
| www.ykp.com.br | BR | Technology | — | 27 ene 2025 |
| www.spmundi.com.br | BR | Manufacturing | — | 27 ene 2025 |
| www.agenciahost.com | BR | Hospitality and Tourism | — | 27 ene 2025 |
| www.constelacion.com.sv | SV | Technology | — | 27 ene 2025 |
| www.industrialdealimentos.com | CO | Agriculture and Food Production | — | 27 ene 2025 |
| www.lapastina.com | BR | Agriculture and Food Production | — | 27 ene 2025 |
Las direcciones de los sitios de filtración (.onion) se conocen pero no se publican ni se enlazan. Solo se muestran metadatos públicos. ética
brune.com.br - Group MC (conglomerate)
icvc.co - Instituto Cardiovascular del Cesar
www.gob.ve
Municipal taxation Secretariat Access - Brazil Goverment