Bablock

BabLock (also referred to as Rorschach) is a ransomware family first seen in 2023. Reporting around the February 2026 cyber incident impacting Sapienza University of Rome links the disruption to BabLock/Rorschach based on observed malware traits and operational patterns, with victim data reported as encrypted. The ransomware is described as “next-generation” and is noted for rapid encryption. Public reporting attributes the Sapienza incident to a purported pro-Russian threat actor tracked as Femwar02 using BabLock/Rorschach-like malware; the reporting also claims the extortion malware typically avoids encrypting devices configured for Russian or other post-Soviet languages. Multiple reports state the attackers provided a ransom-demand link with an alleged 72-hour countdown that would begin only after the link is clicked, and that the victim did not engage/open it, leaving the ransom amount unknown. Code lineage assessments cited in reporting indicate BabLock/Rorschach borrows components from leaked Babuk source code as well as LockBit v2.0 and DarkSide. One report states Rorschach does not operate a dedicated dark-web extortion portal. No specific technical IOCs (hashes, domains, IPs) are provided in the content.