Loading malware…
Babuk, also known as Babyk, is a ransomware family that emerged in early 2021 and initially operated through a ransomware-as-a-service model. It targets enterprise environments, with variants for Windows, Linux, including ARM-based systems, and VMware ESXi. Victims have included organizations in manufacturing, healthcare, transportation, logistics, public services, and critical infrastructure.
Babuk encrypts victim data and demands payment for recovery. Supported cryptographic implementations include ChaCha8 for data encryption and Elliptic Curve Diffie–Hellman for key protection. Encrypted files contain additional cryptographic metadata needed for decryption. Windows variants interrupt backup processes and delete volume shadow copies to inhibit recovery. The original operation customized payloads, ransom notes, and encrypted-file extensions for individual victims. Its operators employed double extortion, combining encryption with threats to publish previously stolen information; data theft was part of the intrusion operation rather than an established native encryptor capability.
Babuk campaigns have used compromised RDP access and exploitation of vulnerable internet-facing servers. Tortilla deployed a Babuk variant against Microsoft Exchange servers through ProxyShell exploitation, using an intermediate unpacking stage to decrypt the payload in memory before execution. Other operators, including Masque and Toy Ghouls, have also used Babuk encryptors.
Leaks of Babuk's builder and source code in 2021 enabled independent actors to generate payloads and develop numerous derivative families, particularly for ESXi. These derivatives do not necessarily indicate involvement by the original Babuk operators. Free decryption tools support variants whose corresponding private keys are known, including the Tortilla variant, but do not provide universal recovery across the family.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
10 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Cisco Talos discovered a Tortilla campaign in our product telemetry on Oct. 12, 2021, targeting vulnerable Microsoft Exchange servers and attempting to exploit the ProxyShell vulnerability to deploy the Babuk ransomware in the victim's environment. | Babuk ransomware emerged in 2021, gaining notoriety for its high-profile attacks on targeted industries, especially those in healthcare, manufacturing, logistics and public services, including critical infrastructure.
ProxyShell is a name given to an attack that chains a trio of vulnerabilities together (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207), to enable unauthenticated attackers to perform remote code execution (RCE) and to snag plaintext passwords. | Tortilla is launching ProxyShell attacks on Microsoft Exchange servers to infect vulnerable servers with variants of the Babuk ransomware.
Suspected China-Nexus Actor Exploits VMware vCenter Flaw, Deploys Babuk-Derived Ransomware
ProxyShell is a name given to an attack that chains a trio of vulnerabilities together (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207), to enable unauthenticated attackers to perform remote code execution (RCE) and to snag plaintext passwords. | Tortilla is launching ProxyShell attacks on Microsoft Exchange servers to infect vulnerable servers with variants of the Babuk ransomware.
QUIRSO have since mapped a sprawling global campaign that compromised 361 unique IP addresses across 47 countries, culminating in the deployment of Babuk-derived ransomware directly onto ESXi hypervisors.
The initial downloader is a modified EfsPotato exploit to target proxyshell and PetitPotam vulnerabilities. | EfsPotato is an exploit that attempts to escalate the process privileges using a vulnerability in the Encrypted File System (CVE-2021-36942). | Cisco Talos recently discovered a malicious campaign deploying variants of the Babuk ransomware predominantly affecting users in the U.S.
According to a Coveware report, Babuk ransomware is also targeting SonicWall VPNs likely vulnerable to CVE-2020-5135 exploits. This vulnerability was patched in October 2020 but it is still "heavily abused by ransomware groups today" per Coveware. | According to a Coveware report, Babuk ransomware is also targeting SonicWall VPNs likely vulnerable to CVE-2020-5135 exploits.
The version of Velociraptor observed in this incident was outdated (version 0.73.4.0) and exposed to a privilege escalation vulnerability (CVE-2025-6264), which may have been leveraged for persistence as this vulnerability can lead to arbitrary command execution and endpoint takeover.
"...others support or sell ESXi encryptors like Akira, Black Basta, Babuk, Lockbit, and Kuiper."
...threat actors have been observed weaponizing a vulnerable version of Bitrix for initial access, followed by using the Zerologon flaw to escalate privileges.
30 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Ранее она использовала сторонние шифровальщики, включая RedAlert, LockBit и Babuk.
Tortilla is launching ProxyShell attacks on Microsoft Exchange servers to infect vulnerable servers with variants of the Babuk ransomware.
Competitor ransomware groups like “Bl00dy,” “Dragonforce,” and “RA World” rely on leaked “Babuk” or “LockBit” builders to launch attacks.
Competitor ransomware groups like “Bl00dy,” “Dragonforce,” and “RA World” rely on leaked “Babuk” or “LockBit” builders to launch attacks.
Competitor ransomware groups like “Bl00dy,” “Dragonforce,” and “RA World” rely on leaked “Babuk” or “LockBit” builders to launch attacks.
22 distinct techniques documented for this family, organized by ATT&CK tactic.
Its purpose is to delete the ransom Note “ How to Restore Your Files.txt ” ... it deletes using the “ DeleteFileW ” the file
By targeting virtual machines, ransomware operators can also encrypt multiple servers at once with a single command. In June, researchers spotted a new REvil ransomware Linux encryptor designed to target VMware ESXi virtual machines, a popular enterprise virtual machine platform.
Tasklist can be used to discover processes running on a system. Numerous malware families and threat groups are described as listing running processes, collecting PIDs, checking for specific process names, or enumerating loaded modules.
After inventory discovery, the attackers created local administrator accounts on ESXi hosts
By targeting virtual machines, ransomware operators can also encrypt multiple servers at once with a single command. In June, researchers spotted a new REvil ransomware Linux encryptor designed to target VMware ESXi virtual machines, a popular enterprise virtual machine platform.
123 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
200 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned as the code base for an Akira lookalike encryptor. The lookalike uses the .akira extension and an imitation ransom note, demonstrating that these artifacts alone cannot establish an Akira infection.
Leaked Babuk codebase was reportedly used to create derived ransomware payloads that encrypt ESXi-hosted virtual machines after compromise of vCenter.
Ransomware family mentioned only as the source of a leaked builder previously used by Toy Ghouls.
Babuk-derived ransomware payloads were deployed after exploitation of VMware vCenter CVE-2026-59310 to encrypt ESXi virtual machines.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.