Babuk

Babuk is a ransomware-as-a-service cybercrime operation first publicly observed in early 2021. It became notable for rapid enterprise targeting, support for both Windows and Linux environments, and later for the public leak of its builder and source code, which influenced subsequent ransomware and extortion activity. Babuk has also been associated with the aliases Babuk Locker and Babuk v2.0, and with the later leak-site branding Payload Bin in the period when the group shifted emphasis away from encryption. Babuk targeted organizations across multiple sectors, including manufacturing, transportation, construction and materials, law firms, and government entities. Reported victim geography prominently included the United States, Canada, Spain, France, and Germany, and the group was also linked to the compromise of the Metropolitan Police Department in Washington, D.C. Babuk publicly recruited affiliates on Russian-speaking cybercrime forums and operated under a RaaS model before internal fractures, law-enforcement pressure, and strategic changes contributed to splintering and rebranding activity. Technically, Babuk developed encryptors for Windows and Linux, including VMware ESXi-focused variants intended to impact virtualized enterprise infrastructure. Babuk malware has been documented using ChaCha-family stream ciphers for file encryption and elliptic-curve key exchange, with later variants using Curve25519. The malware commonly used multithreaded encryption, terminated services and processes that could interfere with encryption, deleted shadow copies, inhibited recovery, and encrypted local drives, network shares, and in some variants LAN-accessible resources. Babuk also demonstrated capability to target ESXi environments, reflecting the broader ransomware trend of maximizing impact by encrypting multiple virtual machines through a single hypervisor compromise. Operationally, Babuk combined encryption with data theft and leak pressure, and later announced a move away from device encryption toward pure data-theft extortion. Its leak infrastructure was rebranded as Payload Bin and was positioned as a platform both for Babuk’s own extortion activity and potentially for other actors’ leaks. Babuk’s ecosystem also extended into the Russian-speaking underground through the RAMP forum, which was tied to the same infrastructure lineage and was used to support ransomware-affiliate and access-broker activity. Babuk’s leaked builder could generate Windows, NAS, and ESXi-targeting payloads and corresponding decryptors. The authenticity of the leak was widely assessed as high, and the leak materially lowered barriers for copycats and derivative families. Multiple later ransomware strains and variants were reported to share code or design similarities with Babuk, especially around ESXi targeting and cryptographic implementation. Babuk is therefore significant not only as an operator but also as a progenitor whose leaked tooling contributed to the broader ransomware threat landscape. Babuk is best characterized as a financially motivated Russian-speaking cybercrime actor focused on enterprise ransomware and extortion.