Loading story…
Researchers analyzed a leaked Babuk ransomware builder and concluded it is likely authentic, showing it can generate platform-specific encryptor and decryptor binaries for Windows, ARM-based NAS devices, and VMware ESXi servers. The leaked package reportedly included a Windows builder executable, binary templates, Unix executables, and a ransom note template, and reverse engineering found strong similarities between builder-produced samples and known Babuk malware, including closely matching structure, encryption behavior, and assembly code. Analysts said the builder can either create elliptic-curve keys automatically or accept a supplied key, allowing operators to reuse the same decryption executable across multiple builds.
The generated Babuk payloads were reported to delete shadow copies, disrupt VSS-related activity, empty the recycle bin, drop ransom notes named "How to Restore Your Files.txt", append the .babyk extension to encrypted files, and add the signature "choung dong looks like hot dog!!". The corresponding decryptor searches for .babyk files, validates and removes the signature, restores file contents, deletes ransom notes, and displays a completion message. Researchers said the leak could help defenders improve IoCs, YARA detections, and tracking of unofficial Babuk variants, while also lowering the barrier for other ransomware actors to reuse the tooling.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
Both analyses state that a builder for the Babuk ransomware family was leaked online in late June or early July 2021, exposing tooling for generating Windows, NAS, and ESXi encryptor and decryptor binaries.
Cyble stated that Babuk was highly active in May 2021 and conducted at least 42 attacks, with the United States, Canada, Spain, France, and Germany listed as the most affected countries.
Cyble reported that the Babuk encryptor binary analyzed in the leaked package was compiled on 2021-03-23 19:22:40 as a GUI-based x86 C/C++ application.
Static analysis cited by Cyble found builder.exe was compiled on 2021-03-16 10:03:10 as a console-based x86 C/C++ application.
Cyble reported that Babuk came to light in January 2021 after impacting at least five large enterprises across multiple sectors.
Lab52 obtained and analyzed the leaked package and concluded it was very likely an authentic Babuk builder, while Cyble separately documented its build process and generated binaries for multiple platforms.
Lab52 reported that the leaked builder was uploaded to VirusTotal, where Kevin Beaumont identified the sample as a Babuk ransomware builder.
Lab52 said the builder leak occurred after Babuk publicly moved away from ransomware-as-a-service operations toward data-leak extortion.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SentinelLABS reported that at least 10 ransomware families built VMware ESXi encryptors from the leaked 2021 Babuk source code, turning the builder into a common foundation for hypervisor-focused attacks. The research linked code and behavioral overlaps between Babuk and ESXi lockers associated with **Play**, **Mario/Ransom House**, **Conti**, and possibly **REvil**, showing how the leak reduced the effort needed to develop Linux and ESXi ransomware. The report said adoption of Babuk-derived ESXi lockers accelerated through late 2022 and early 2023, particularly among less-resourced threat actors seeking to target virtualized environments. SentinelLABS also warned that widespread code reuse now complicates attribution across ransomware operations, and said **ESXiArgs** was likely misattributed as Babuk-derived because the overlap appears limited to its use of the `Sosemanuk` cipher implementation.
Jun 29, 2026
A leaked **LockBit 3.0** builder and companion key-generation utility exposed how the ransomware operation creates customized encryptor and decryptor payloads, raising concern that other actors could launch LockBit-derived campaigns. Technical analyses said the toolkit included files such as `Builder.exe`, `Keygen.exe`, `Build.bat`, and `config.json`, and could package RSA keys, configuration data, ransom-note text, and embedded resources into PE executables or DLLs for both encryption and decryption workflows. Reports linked the leak to claims that a third party had infiltrated LockBit infrastructure and later shared the builder publicly, while LockBit reportedly downplayed the incident and blamed a dismissed developer. The leaked code also revealed operational and defensive-evasion details from one of the most prolific ransomware-as-a-service groups. Researchers said **LockBit 3.0**—also known as **LockBit Black** and tied to BlackMatter lineage—used anti-analysis measures including runtime decryption, debugger checks, trampolines, and manipulation of `DbgUiRemoteBreakin`, while preserving capabilities for privilege escalation, persistence, process and service termination, rapid encryption, and ransom-note deployment. Analyses of the builder described support for exclusion lists, C2 URLs, impersonation accounts, and cryptographic routines including RSA key handling, MIRACL-based generation, hardware-assisted randomness via `RDRAND` and `RDSEED`, and creation of victim-specific identifiers, giving defenders and criminals alike an unusually detailed view into LockBit’s tooling.
Aug 15, 2026
Ransomware operators are increasingly building campaigns around leaked, published, purchased, or affiliate-provided malware instead of developing their own tooling, lowering the barrier to entry for new and mid-tier cybercrime groups. Research highlighted **SEXi** as a group targeting VMware **ESXi** environments with leaked **Babuk** code for Linux and leaked **LockBit** code for Windows, showing how previously exposed ransomware builders continue to enable active attacks across mixed environments. The same reporting identified **Key Group** as an operator that has rotated through at least eight ransomware families since 2022 while relying on comparatively unsophisticated infrastructure, and **Mallox** as an operation that evolved from a private group into an affiliate program with selective recruitment. The findings indicate that leaked ransomware variants remain operationally dangerous even when used by less mature actors, because affiliate models, niche targeting, and access to proven encryptors can still support effective intrusions and larger-scale **big game hunting** campaigns.
Jun 29, 2026