Skip to main content

Babuk ransomware is back, uses new version on corporate networks

 


After announcing their exit from the ransomware business in favor of data theft extortion, the Babuk gang appears to have slipped back into their old habit of encrypting corporate networks.

The criminals are currently using a new version of their file-encrypting malware and have moved the operation to a new leak site that lists a handful of victims.

Gang’s still in the game


The Babuk ransomware group became known at the beginning of the year but the gang says that their attacks had started in mid-October 2020, targeting companies across the world and demanding ransoms typically between $60,000 and $85,000 in bitcoin cryptocurrency. In some cases, victims were asked hundreds of thousands for data decryption.

One of their most publicized victims is the Washinton DC’s Metropolitan Police Department (MPD). This attack likely pushed the threat actor into announcing its retirement from the ransomware business only to adopt another extortion model that did not include encryption.

The gang also announced plans to release their malware so that other cybercriminals could start a ransomware-as-a-service operation. The threat actor kept its promise and published its builder, a tool that generates customized ransomware.

Security researcher Kevin Beaumont found it on VirusTotal and shared the information to help the infosec community with detection and decryption.

After shutting down in April, the gang took the name PayLoad Bin, but their leak site shows little activity. Instead, a new leak site emerged on the dark web carrying the Babuk ransomware markings.

The site lists fewer than five victims that refused to pay the ransom and that they have been attacked with a second version of the malware.

It appears that Babuk has not given up the encryption-based extortion game. They released only the old version of their malware and created a new one to get back into the ransomware business.

The gang made this clear in a comment to our article about a rush of ransomware attacks that used the leaked Babuk builder and demanded .006 bitcoins (currently about $200) — clearly showing that it’s not the original group using it.

It appears that the Babuk gang is not ready to give up the file-encryption activity and will continue to focus on corporate networks for larger payments.

It is unclear what drove the group to return to their old practices but given how empty the PayLoad Bin leak site is, one can speculate that data theft extortion did not go too well.

Also, it remains unknown at the moment if the new Babuk operation has behind it the same members that attacked Washinton DC’s Metropolitan Police Department or this incident produced a split.


Originally published at https://www.bleepingcomputer.com.

Comments

Post a Comment

Popular posts from this blog

Ex-Twitter employees accused of spying for Saudi Arabia

Two former employees of Twitter have been charged in the US with spying for Saudi Arabia. The charges, unsealed on Wednesday in San Francisco, allege that Saudi agents sought personal information about Twitter users including known critics of the Saudi government. Court documents  named the two as Ahmad Abouammo, a US citizen, and Ali Alzabarah, from Saudi Arabia. A third person, Saudi citizen Ahmed Almutairi, is also accused of spying. The New York Times says it is the first time that Saudi citizens have been charged with spying inside the United States. What are the charges? The charges allege Mr Almutairi acted as an intermediary between the two Twitter employees and Saudi officials. Ahmad Abouammo appeared in a Seattle court on Wednesday and was remanded in custody pending another hearing due on Friday. He is also charged with falsifying documents and making false statements to the FBI. Mr Abouammo is said to have left his job as a media partnership manager ...
Post a Comment
Read more

Microsoft rolls out passwordless login for all Microsoft accounts

  Microsoft is rolling out passwordless login support over the coming weeks, allowing customers to sign in to Microsoft accounts without using a password. The company first allowed commercial customers to rollout passwordless authentication in their environments in March after a breakthrough year in 2020 when Microsoft reported that over 150 million users were logging into their Azure Active Directory and Microsoft accounts without using a password. Rolling out to all Microsoft accounts Starting today, Redmond announced that users are no longer required to have a password on their accounts. Instead, they can choose between the Microsoft Authenticator app, Windows Hello, a security key, or phone/email verification codes to log into Microsoft Edge or Microsoft 365 apps and services. “Now you can remove the password from your Microsoft account and sign in using passwordless methods like Windows Hello, the Microsoft Authenticator mobile app or a verification code sent to your phone o...
Post a Comment
Read more