Loading malware…
Babuk is a ransomware family that emerged in early 2021 and became notable for fast encryption, multi-platform support, and later source-code and builder leaks that enabled numerous derivative strains. It has been associated with attacks against large enterprises and organizations across sectors including manufacturing, transportation, construction, legal services, and virtualized infrastructure environments. Babuk has also been linked in public reporting to affiliate-style criminal operations and to actors later accused of participating in Babuk-related ransomware activity.
Babuk supports both Windows and Linux-based targets, including VMware ESXi hypervisors and NAS systems. Its leaked builder was capable of generating platform-specific encryptor and decryptor binaries for Windows, ESXi, and NAS architectures, which contributed to broad code reuse by later ransomware families and variants. Babuk-derived malware has been observed in subsequent campaigns and has influenced families such as AstraLocker, DarkyLock, and other opportunistic forks built from leaked code.
On Windows, Babuk has been reported to enumerate processes, use native Windows API calls for discovery and execution, remove shadow copies, stop services and processes that interfere with encryption, empty the recycle bin, and create ransom notes in affected directories. It appends a characteristic encrypted-file extension in many observed variants. Babuk also has the ability to enumerate network shares, supporting broader impact across reachable storage. On ESXi, Babuk includes a dedicated encryptor targeting virtual-machine-related files, making it effective against consolidated virtual infrastructure. Some Babuk-derived deployments on ESXi have been used in intrusion chains following compromise of VMware management infrastructure, where ransomware appeared to serve either as the primary monetization stage or as a destructive smokescreen to hinder forensic investigation.
Babuk is significant not only as an active ransomware family but also as a progenitor codebase in the ransomware ecosystem. Public leaks of its source and builder materially lowered the barrier to entry for other operators, accelerating the appearance of new ransomware brands and variants with overlapping functionality and code structure.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
10 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
QUIRSO confirmed this week that a suspected China-nexus APT began exploiting CVE-2026-59310 (CVSS 9.8), a critical directory traversal vulnerability in the VMware vCenter Syslog Server, just five days after Broadcom publicly disclosed the patch on July 29, 2026, with 361 victim IP addresses now confirmed across 47 countries. | ...ultimately deploys a Babuk-derived ransomware that encrypts ESXi host files with the .babyk extension, likely as a smokescreen to destroy forensic evidence of the primary intrusion.
QUIRSO have since mapped a sprawling global campaign that compromised 361 unique IP addresses across 47 countries, culminating in the deployment of Babuk-derived ransomware directly onto ESXi hypervisors.
The flaws are tracked as CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207. | A Hive ransomware affiliate has been targeting Microsoft Exchange servers vulnerable to ProxyShell security issues... ProxyShell is a set of three vulnerabilities in the Microsoft Exchange Server that allow remote code execution without authentication on vulnerable deployments. The flaws are tracked as CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207. | The flaws have been used by multiple threat actors, including ransomware like Conti, BlackByte, Babuk, Cuba, and LockFile, after exploits became available.
The initial downloader is a modified EfsPotato exploit to target proxyshell and PetitPotam vulnerabilities. | EfsPotato is an exploit that attempts to escalate the process privileges using a vulnerability in the Encrypted File System (CVE-2021-36942). | Cisco Talos recently discovered a malicious campaign deploying variants of the Babuk ransomware predominantly affecting users in the U.S.
The flaws are tracked as CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207. | The flaws have been used by multiple threat actors, including ransomware like Conti, BlackByte, Babuk, Cuba, and LockFile, after exploits became available.
The flaws are tracked as CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207. | The flaws have been used by multiple threat actors, including ransomware like Conti, BlackByte, Babuk, Cuba, and LockFile, after exploits became available.
According to a Coveware report, Babuk ransomware is also targeting SonicWall VPNs likely vulnerable to CVE-2020-5135 exploits. This vulnerability was patched in October 2020 but it is still "heavily abused by ransomware groups today" per Coveware. | According to a Coveware report, Babuk ransomware is also targeting SonicWall VPNs likely vulnerable to CVE-2020-5135 exploits.
The version of Velociraptor observed in this incident was outdated (version 0.73.4.0) and exposed to a privilege escalation vulnerability (CVE-2025-6264), which may have been leveraged for persistence as this vulnerability can lead to arbitrary command execution and endpoint takeover.
"...others support or sell ESXi encryptors like Akira, Black Basta, Babuk, Lockbit, and Kuiper."
...threat actors have been observed weaponizing a vulnerable version of Bitrix for initial access, followed by using the Zerologon flaw to escalate privileges.
25 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Indictments returned in New Jersey and the District of Columbia allege that Matveev was involved in a conspiracy to distribute ransomware from three different strains or affiliate groups, including Babuk, Hive and LockBit.
Babuk Ransomware v3 Overview This is a short report for the latest Babuk ransomware sample. This sample is marked as version 3 based on the run-once mutex string.
Babuk, an advanced ransomware strain, was publicly discovered in 2021... Avast is releasing an updated version of the Avast Babuk decryption tool, capable of restoring files encrypted by the Babuk variant called Tortilla.
Ce groupe utilisait auparavant des ransomwares tiers (RedAlert, LockBit, Babuk).
19 distinct techniques documented for this family, organized by ATT&CK tactic.
The content repeatedly describes threat actors and malware using cmd.exe, the Windows command shell, to execute commands, launch payloads, run batch files, and automate actions on compromised hosts.
Its purpose is to delete the ransom Note “ How to Restore Your Files.txt ” ... it deletes using the “ DeleteFileW ” the file
The content is a long ATT&CK-style listing of malware and threat groups that 'decrypt', 'decode', 'deobfuscate', 'unpack', or 'decompress' payloads, strings, configuration data, shellcode, and files prior to execution or use.
By targeting virtual machines, ransomware operators can also encrypt multiple servers at once with a single command. In June, researchers spotted a new REvil ransomware Linux encryptor designed to target VMware ESXi virtual machines, a popular enterprise virtual machine platform.
Babuk and Rook use EnumDependentServicesA API to retrieve the name and status of each service that depends on the specified service before terminating. They enumerate all services in the system and stop all of those which exist in a hardcoded list in the malware.
Tasklist can be used to discover processes running on a system. Numerous malware families and threat groups are described as listing running processes, collecting PIDs, checking for specific process names, or enumerating loaded modules.
MITRE ATT&CK® Techniques Tactic Technique ID Technique Name Execution T1204 User Execution Discovery T1082 System Information Discovery
The content is a long ATT&CK-style listing of groups and malware that can 'list files and directories,' 'search for files,' 'enumerate drives,' 'gather file metadata,' or 'browse file systems' on compromised hosts.
Numerous entries mention enumerating drives, logical disks, disk type, free space, or volume information; examples include 'Babuk can enumerate disk volumes,' 'Cuba can enumerate local drives,' and 'TAINTEDSCRIBE can use DriveList to retrieve drive information.'
APT1 listed connected network shares. APT32 used the net view command to show all shares available, including the administrative shares such as C$ and ADMIN$. APT41 used the net share command as part of network reconnaissance.
By targeting virtual machines, ransomware operators can also encrypt multiple servers at once with a single command. In June, researchers spotted a new REvil ransomware Linux encryptor designed to target VMware ESXi virtual machines, a popular enterprise virtual machine platform.
ultimately deploys a Babuk-derived ransomware that encrypts ESXi host files with the .babyk extension
For each dependent service, the malware calls OpenServiceA to retrieve its handle and ControlService to send a control stop code to stop it. | For each process whose name is in the list of processes to be terminated, the malware calls OpenProcess to retrieve the process’s handle and TerminateProcess to terminate it.
108 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
170 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Babuk-derived ransomware deployed post-compromise on VMware vCenter/ESXi environments to encrypt ESXi host files, apparently used here as a destructive smokescreen to hinder forensic investigation after initial root-level access and persistence are established.
Ransomware deployed against VMware ESXi hypervisors that encrypts virtual machine files, configuration data, and virtual disks, appending the .babyk extension. The article describes it as a Babuk-derived strain used in the final destructive phase of the intrusion.
A ransomware family referenced here only as the apparent basis for a Babuk-derived payload used to encrypt ESXi host files with the .babyk extension.
Previously used third-party ransomware family referenced as part of Toy Ghouls' tooling history before developing GenieLocker.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.