Babuk2 ransomware

Who Babuk2 is

Babuk Locker 2.0, also known as Bjorka or SkyWave, after failing to make any profit from selling public databases on forums, decided to impersonate Babuk Ransomware group. He launched a blog where he claimed multiple public breaches from BreachForums as ransomware attacks

Recorded activity

Disclosures attributed to Babuk2 in this database run from January 2025 to April 2025, totalling 180 victims — 0.8% of everything tracked here. Babuk2 has listed victims in 52 countries in this database, most often United States, followed by Brazil and India. The sectors appearing most in its listings are Public Sector, Technology, Healthcare.

Indicators of compromise

• [email protected]

Showing a sample of 1 EMAIL on file. Hashes and network indicators published for Babuk2. Leak-site addresses are deliberately excluded. Indicators age quickly — treat a match as a starting point for investigation, and an absence of matches as no assurance.

YARA detection rules

/*
babuk2 ransomware
*/

rule babuk2_Ransomnote
{
    meta:
        author = "ransomware.live"
        family = "ransomware.babuk2"
        description = "Detects babuk2 ransomware ransom note or artifact"
        date = "2026-05-04"
        severity = 7
        score = 70

    strings:
        $name1 = "babuk2" ascii nocase
        $name2 = "BABUK2" ascii
        $onion  = "babuk2.onion" ascii nocase

    condition:
        any of them
}

Community-contributed rules for Babuk2, reproduced as published. Test them against your own corpus before relying on them: rule quality and false-positive behaviour vary by author.