Security News > 2021 > June > Leaked Babuk Locker ransomware builder used in new attacks
A leaked tool used by the Babuk Locker operation to create custom ransomware executables is now being used by another threat actor in a very active campaign targeting victims worldwide.
Babuk Locker was a ransomware operation that launched at the beginning of 2021 when it began targeting corporate victims and stealing their data in double-extortion attacks.
Last week, security researcher Kevin Beaumont discovered that someone uploaded the Babuk operation's ransomware builder to VirusTotal.
Soon after the builder was leaked online, a threat actor began using it to launch a very active ransomware campaign.
Compared to the original Babuk Ransomware operation that demanded hundreds of thousands, if not millions, of dollars to recover their files, this new threat actor is only asking for.006 bitcoins or approximately $210 from their victims.
It is unclear how the ransomware is being distributed, but we have created a dedicated Babuk Locker support topic that victims can use to share more information about the attack.
News URL
Related news
- Leaked Black Basta Ransomware Chat Logs Reveal Inner Workings and Internal Conflicts (source)
- Southern Water says Black Basta ransomware attack cost £4.5M in expenses (source)
- Qilin ransomware claims attack at Lee Enterprises, leaks stolen data (source)
- Ransomware gangs exploit Paragon Partition Manager bug in BYOVD attacks (source)
- Hackers Exploit Paragon Partition Manager Driver Vulnerability in Ransomware Attacks (source)
- Hunters International ransomware claims attack on Tata Technologies (source)
- Toronto Zoo shares update on last year's ransomware attack (source)
- Ransomware gang creates tool to automate VPN brute-force attacks (source)
- SANS Institute Warns of Novel Cloud-Native Ransomware Attacks (source)
- ⚡ THN Weekly Recap: Router Hacks, PyPI Attacks, New Ransomware Decryptor, and More (source)