A new ransomware variant, dubbed Rook, that borrows source code from Babuk has surfaced. It is being primarily delivered via fake torrent downloads as well as phishing emails in some cases. At present, its...
The new Rook ransomware is primarily delivered via a third-party framework, for example Cobalt Strike; however, delivery via phishing email has also been reported in the wild. click here to read full Article Read...
Cisco Talos red-flagged a new campaign by Tortilla, one of Babuk’s affiliates, for targeting ProxyShell flaws in Exchange Server in an attempt to breach corporate networks. The gang asks for around $10,000 ransom in...
Researchers assess with moderate confidence that the initial infection vector is the exploitation of ProxyShell flaws in Microsoft Exchange Server through the deployment of China Chopper web shell. click here to read full Article...
The ProxyShell attacks against vulnerable Microsoft Exchange servers started several months ago, with LockFile and Conti being among the first ransomware groups to exploit them. click here to read full Article Read more on...
Talos researchers warn of a new threat actor that is hacking Microsoft Exchange servers by exploiting ProxyShell flaws to gain access to corporate and deploy the Babuk Ransomware. click here to read full Article...
The FBI has issued a flash alert warning against the HelloKitty ransomware group who recently started threatening victims with DDoS attacks. The group’s ransom demands fluctuate for each victim and are based on their ability...
As first noticed by security researcher vx-underground, an alleged member of the Babuk group released the full source code for their ransomware on a popular Russian-speaking hacking forum. click here to read full Article...
A recent announcement on their forum indicates that the infamous Babuk ransomware operators are now expressly targeting Linux/UNIX systems, as well as ESXi and VMware systems. click here to read full Article Read more...
A spammer has flooded the forum of the Babuk ransomware group with explicit GIFs after the Babuk gang failed to pay a $5,000 ransom demand the threat actor made on Friday. click here to...
At the end of May, the Babuk ransomware operators rebranded their ransomware leak site into Payload[.]bin and started offering the opportunity to other gangs to use it to leak data stolen from their victims....
The Babuk ransomware gang appears to be back in action after a hiatus as it was found targeting and encrypting multiple corporate networks. It indicates that businesses are still facing enormous threats from the...
Soon after its apparent departure, the notorious Babuk ransomware is once again back in action.… Babuk Ransomware Gang Is Back In Business With New Malware on Latest Hacking News. click here to read full...
The Babuk ransomware gang’s source code has been uploaded to VirusTotal, making it available to all security vendors and competitors. It’s unclear however just how that happened. click here to read full Article Read...
After the Babuk ransomware operators have announced that they decided to close the affiliate program and move to data theft extortion, the group seems to have returned to their previous methods of encrypting corporate...
After announcing their exit from the ransomware business in favor of data theft extortion, the Babuk gang appears to have slipped back into their old habit of encrypting corporate networks. click here to read...
