Threat intelligence / Malware

Babuk

[Babuk](https://attack.mitre.org/software/S0638) is a Ransomware-as-a-service (RaaS) malware that has been used since at least 2021. The operators of [Babuk](https://attack.mitre.org/software/S0638) employ a "Big Game Hunting" approach to targeting major enterprises and operate a leak site to post stolen data as part of their extortion scheme.(Citation: Sogeti CERT ESEC Babuk March 2021)(Citation: McAfee Babuk February 2021)(Citation: CyberScoop Babuk February 2021)

Malware

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Babuk](https://attack.mitre.org/software/S0638) is a Ransomware-as-a-service (RaaS) malware that has been used since at least 2021. The operators of [Babuk](https://attack.mitre.org/software/S0638) employ a "Big Game Hunting" approach to targeting major enterprises and operate a leak site to post stolen data as part of their extortion scheme.(Citation: Sogeti CERT ESEC Babuk March 2021)(Citation: McAfee Babuk February 2021)(Citation: CyberScoop Babuk February 2021)

Labels

malware

14 recorded

Relationships

uses

to Data Encrypted for Impact

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to Disable or Modify Tools

Technique

uses

to File and Directory Discovery

Technique

uses

to Inhibit System Recovery

Technique

uses

to Local Storage Discovery

Technique

uses

Technique

uses

to Network Share Discovery

Technique

uses

to Process Discovery

Technique

uses

to Service Stop

Technique

uses

to Software Packing

Technique

uses

to System Network Connections Discovery

Technique

uses

to System Service Discovery

Technique

uses

to Windows Command Shell

Technique

7 external

References

mitre-attack

S0638

Vasa Locker

—

Babyk

—

Trend Micro Ransomware February 2021

https://www.trendmicro.com/en_us/research/21/b/new-in-ransomware.html

CyberScoop Babuk February 2021

https://www.cyberscoop.com/babuk-ransomware-serco-attack/

McAfee Babuk February 2021

https://www.mcafee.com/enterprise/en-us/assets/reports/rp-babuk-ransomware.pdf

Sogeti CERT ESEC Babuk March 2021

https://www.sogeti.com/globalassets/reports/cybersecchronicles_-_babuk.pdf