Description Summary
Babuk Ransomware is a sophisticated ransomware compiled for several platforms. Windows and ARM for Linux are the most used compiled versions, but ESX and a 32bit old PE executable were observed over time. as well It uses an Elliptic Curve Algorithm (Montgomery Algorithm) to build the encryption keys.
Threat Actor
Closed group; Windows, Linux/ESXi and ARM builds. Full source code leaked, spawning Babuk2, Rook, RA World, Nokoyawa and others.
Technical Indicators
Encryption Extension
.babyk / .babuk / variant-specific
Encryption Algorithm
Elliptic Curve (Curve25519/Montgomery) + ChaCha8/AES
Ransom Note Name
How To Restore Your Files.txt
Targeted Industries
Cross-sector (incl. Washington DC Police)
First Seen
January 2021
Last Seen
2021 (source/builder leaked Sept 2021; basis for many variants)
Geographical Location
Worldwide
MITRE ATT&CK Matrix
| Tactic | TTP | Technique Name |
|---|---|---|
| Impact x 2 | T1486 | Data Encrypted for Impact |
| T1490 | Inhibit System Recovery | |
| Exfiltration x 1 | T1567 | Exfiltration Over Web Service (leak site) |
| Initial Access x 2 | T1190 | Exploit Public-Facing Application |
| T1078 | Valid Accounts |