Babuk (Ransomware) – Malware

Babuk
Type of Malware	Ransomware
Addittional Names	Babyk Vasa Locker
Associated Groups	Evil Corp
Date of Initial Activity	2020
Motivation	Financial Gain
Attack Vectors	Phishing Remode Desktop Protocol(RDP)
Targeted Systems	Windows Linux

Overview

Babuk ransomware, a sophisticated strain of malware first discovered in 2020, quickly gained notoriety for its advanced encryption techniques and rapid spread. It primarily targets high-value sectors like healthcare, finance, and critical infrastructure. Babuk operates under a Ransomware-as-a-Service (RaaS) model, allowing cybercriminal affiliates to deploy the malware for financial gain. Notable for its ability to exfiltrate sensitive data, it uses AES-256 encryption and is often distributed through phishing emails, RDP exploits, and vulnerabilities. Babuk has proven to be highly effective, making it a significant threat to organizations worldwide.

Targets

Information Educational Services Public Administration Health Care and Social Assistance

How they operate

Babuk ransomware operates with a high degree of sophistication, leveraging a combination of advanced encryption and rapid deployment techniques. After initial access—typically gained through phishing, exploited vulnerabilities, or RDP brute force—Babuk establishes a persistent foothold in the victim’s environment. It then uses the Cobalt Strike framework to escalate privileges and move laterally across the network. The ransomware employs AES-256 encryption to lock files, targeting critical data such as documents, images, and backup files. Additionally, Babuk is capable of deleting system restore points and shadow copies, making recovery more difficult without paying the ransom. Beyond encryption, it also exfiltrates sensitive data like user credentials and financial information, which it may threaten to release unless the victim complies with ransom demands. Babuk’s modular structure allows it to execute different functions such as scanning for specific file types and controlling encryption speed. The ransomware’s speed is a notable feature; it encrypts data quickly, minimizing the time it takes to impact an organization. Once the encryption process is complete, a ransom note is displayed with instructions on how to pay and prevent the leak of stolen data. In addition to these technical aspects, Babuk’s operators use their RaaS (Ransomware-as-a-Service) model, offering the ransomware to affiliates. This allows for more widespread deployment and faster propagation across various sectors, contributing to its rapid rise in prominence.