Babuk (ELF)
- First seen
- 2021-01-01 00:00:00
- Malware type
- ransomware
- Family
- Malware family
- Profile updated
- 2026-07-07 13:15:33
Targeted industries: government-and-public-sector healthcare-and-pharmaceutical financial-services manufacturing
Context
Babuk is a ransomware variant known for targeting enterprise systems, specifically ESX and NAS environments. It employs encryption techniques to lock sensitive data and demands ransom for decryption.
Reports & references
- Kaspersky — 114990 (report)
- blogs.vmware.com — Esxi Targeting Ransomware The Threats That Are After Your Virtual Machines Part 1 (report)
- CrowdStrike — Big Game Hunting On The Rise Again According To Ecrime Index (report)
- CrowdStrike — Hypervisor Jackpotting Ecrime Actors Increase Targeting Of Esxi Servers (report)
- Broadcom/Symantec — The Ransomware Threat September 2021 (report)
- medium.com — Blackmatter X Babuk Using The Same Web Server For Sharing Leaked Files D01C20A74751 (report)
- medium.com — Groove X Ramp The Relation Between Groove Babuk Ramp And Blackmatter F75644F8F92D (report)
- medium.com — Grooves Thoughts On Blackmatter Babuk And Interruption In The Supply Of Cheese In The B5328Bc764F2 (report)
- McAfee — How Groove Gang Is Shaking Up The Ransomware As A Service Market To Empower Affiliates (report)
- raw.githubusercontent.com — Insomnihack 2022 Ransomware Encryption Internals (report)
- malpedia.caad.fkie.fraunhofer.de — Elf.Babuk (report)
- advintel.io — Groove Vs Babuk Groove Ransom Manifesto Ramp Underground Platform Secret Inner Workings (report)
- krebsonsecurity.com — Russian Hacker Wazawaka Indicted For Ransomware (report)
- marcoramilli.com — Babuk Ransomware The Builder (report)