babuk2
Also known as: SatanlockFirst seen January 27, 2025Active180 claimed victims
The claims below are reproduced as posted by babuk2 on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Babuk Locker 2.0, also known as Bjorka or SkyWave, after failing to make any profit from selling public databases on forums, decided to impersonate Babuk Ransomware group. He launched a blog where he claimed multiple public breaches from BreachForums as ransomware attacks
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| tecnologias.mspz2.gob.ec | April 6, 2025 | ransomware_live | — |
| rheinmetall.com (Rheinmetall Defence) | April 4, 2025 | ransomware_live | — |
| turkish defense military | April 4, 2025 | ransomware_live | — |
| zalora.sg (Singapore Shopping) | April 3, 2025 | ransomware_live | — |
| Polizia italia mail access | April 3, 2025 | ransomware_live | — |
| kfar hatta medical center - Lebanon | April 3, 2025 | ransomware_live | — |
| Iran gas service system | April 3, 2025 | ransomware_live | — |
| ezbuy.sg (Singapore Shopping) | April 3, 2025 | ransomware_live | — |
| Hellenic Airforce | April 3, 2025 | ransomware_live | — |
| Saudi Arabian military and government internal center | April 3, 2025 | ransomware_live | — |
| Bangladesh Armed Forces (BangLadesh Army) | April 3, 2025 | ransomware_live | — |
| Secret plans of Indian army | April 3, 2025 | ransomware_live | — |
| gangotreehomes.com (RealEstate) | April 3, 2025 | ransomware_live | — |
| drdo.gov.in | April 2, 2025 | ransomware_live | — |
| navy-mil-bd | April 2, 2025 | ransomware_live | — |
| aosense.com - AO Sense INC. | April 2, 2025 | ransomware_live | — |
| (UPDATE) - whitecapcanada.com | April 1, 2025 | ransomware_live | — |
| uniproof.com.br | April 1, 2025 | ransomware_live | — |
| moh.gov.rw | March 31, 2025 | ransomware_live | — |
| pln.co.id - PLN INDONESIA | March 31, 2025 | ransomware_live | — |
| theeyeclinicsurgicenter.com - The Eye Clinic Surgicenter company | March 29, 2025 | ransomware_live | — |
| Atlantic Coast Consulting Inc | March 29, 2025 | ransomware_live | — |
| La Futura | March 29, 2025 | ransomware_live | — |
| icvc.co - Instituto Cardiovascular del Cesar | March 29, 2025 | ransomware_live | — |
| brune.com.br - Group MC (conglomerate) | March 29, 2025 | ransomware_live | — |
| iDRAC (Integrated Dell Remote Access Controller) management interface for Dell servers | March 29, 2025 | ransomware_live | — |
| unired.uz | March 28, 2025 | ransomware_live | — |
| pureincubation.com | March 28, 2025 | ransomware_live | — |
| healthcasts.com | March 28, 2025 | ransomware_live | — |
| leadzen.ai | March 28, 2025 | ransomware_live | — |
| nadra.gov.pk - NADRA official Of Pakistan Army & (Andhra Pradesh) | March 27, 2025 | ransomware_live | — |
| israel Infrastructure & Secret Documents intelligence information | March 26, 2025 | ransomware_live | — |
| mot.gov.iq - Iraqi Ministry of Commerce (Of Trade) | March 26, 2025 | ransomware_live | — |
| aman-iraq.com | March 26, 2025 | ransomware_live | — |
| crimsgroup.com | March 26, 2025 | ransomware_live | — |
| kalesavunma.com - KALE SAVUNMA. | March 25, 2025 | ransomware_live | — |
| iberdrola.com (Spain energy) | March 24, 2025 | ransomware_live | — |
| airexplore.aero | March 24, 2025 | ransomware_live | — |
| jp-property.com | March 22, 2025 | ransomware_live | — |
| inmarsat.com | March 22, 2025 | ransomware_live | — |
| Synesis Surveillance System | March 22, 2025 | ransomware_live | — |
| Standard Capital Securities (Pvt) Backoffice - Pakistan Stock Market Data Vault | March 21, 2025 | ransomware_live | — |
| exostar.com TOP Defense AS | March 21, 2025 | ransomware_live | — |
| Mpaj.gov.my | March 21, 2025 | ransomware_live | — |
| The Ticktin Law Group | March 21, 2025 | ransomware_live | — |
| armetal.com | March 21, 2025 | ransomware_live | — |
| smic.mi.th (Thailand Intelligence Agency) | March 20, 2025 | ransomware_live | — |
| mof.go.th - Ministry of Finance (Thailand) | March 20, 2025 | ransomware_live | — |
| woqod.com | March 20, 2025 | ransomware_live | — |
| Corporate access, up to Shipping Apps in QATAR | March 20, 2025 | ransomware_live | — |
| fr.sodexo.com | March 20, 2025 | ransomware_live | — |
| amazon.com | March 20, 2025 | ransomware_live | — |
| mohrss.gov.cn ( Ministry of Human Resources and Social Security ) | March 20, 2025 | ransomware_live | — |
| nimapinfotech.com | March 19, 2025 | ransomware_live | — |
| rac.gov.my | March 19, 2025 | ransomware_live | — |
| Intelligence Bureau of the Joint Staff Department of the Central Military Commission... | March 19, 2025 | ransomware_live | — |
| Municipal taxation Secretariat Access - Brazil Goverment | March 19, 2025 | ransomware_live | — |
| United States County Palm Beach Goverment | March 19, 2025 | ransomware_live | — |
| Access Panel Financial Technology Company (Thailand) | March 19, 2025 | ransomware_live | — |
| www.gob.ve | March 19, 2025 | ransomware_live | — |
| highwirepress.com | March 18, 2025 | ransomware_live | — |
| Otelier.io | March 18, 2025 | ransomware_live | — |
| sp.tnitelecom.com | March 18, 2025 | ransomware_live | — |
| hcahealthcare.com INC. | March 18, 2025 | ransomware_live | — |
| whitecapcanada.com | March 18, 2025 | ransomware_live | — |
| dukcapil.kemendagri.go.id (SIAK DUKCAPIL MINISTRY OF HOME AFFAIRS OF INDONESIA) | March 18, 2025 | ransomware_live | — |
| pajak.go.id | March 18, 2025 | ransomware_live | — |
| nstda.or.th | March 18, 2025 | ransomware_live | — |
| esaote.com | March 18, 2025 | ransomware_live | — |
| icmr.gov.in | March 17, 2025 | ransomware_live | — |
| This entry has been removed following a request from the company | March 17, 2025 | ransomware_live | — |
| taobao.com | March 17, 2025 | ransomware_live | — |
| Orange.com | March 16, 2025 | ransomware_live | — |
| Florida Department of Transportation (FDOT) | March 16, 2025 | ransomware_live | — |
| JD.com Inc (Chinese) | March 16, 2025 | ransomware_live | — |
| Ministry Of Defense of the Republic Of Korea | March 16, 2025 | ransomware_live | — |
| nrru.ac.th - University | March 15, 2025 | ransomware_live | — |
| Belarus E-commerce & Energy Data | March 15, 2025 | ransomware_live | — |
| Indian military and government defense 20TB | March 14, 2025 | ransomware_live | — |
| Intelligence Bureau of the Joint Staff Department of the Central Military Commission China | March 14, 2025 | ransomware_live | — |
| web.asia.edu.tw - Taiwan (Asia University) | March 14, 2025 | ransomware_live | — |
| parliament.iq | March 14, 2025 | ransomware_live | — |
| movistar.com.pe | March 14, 2025 | ransomware_live | — |
| The Ministry of National Defense - mod.gov.vn (NavyVietnam) | March 14, 2025 | ransomware_live | — |
| iaai.com - Washington DC DMV | March 14, 2025 | ransomware_live | — |
| Iraqi Council of Ministers | March 13, 2025 | ransomware_live | — |
| Iraqi Ministry of Finance | March 13, 2025 | ransomware_live | — |
| nuclep.gov.br. Nuclep Brazil | March 13, 2025 | ransomware_live | — |
| cch.org.tw - Changhua Christian Hospital | March 13, 2025 | ransomware_live | — |
| Taiwan - Mackay Hospital | March 13, 2025 | ransomware_live | — |
| Baykar Turkish defense company C4I and artificial intelligence | March 12, 2025 | ransomware_live | — |
| India's telecommunication network | March 12, 2025 | ransomware_live | — |
| hitekgroup.in india Finance | March 12, 2025 | ransomware_live | — |
| marinabaysands.com - Singapore Hotel (Internal Server) | March 12, 2025 | ransomware_live | — |
| forvismazars.com.fr ( mazars.fr ) | March 11, 2025 | ransomware_live | — |
| lexmark.com Company | March 11, 2025 | ransomware_live | — |
| wapda.gov.pk | March 11, 2025 | ransomware_live | — |
| fnde.gov.br brazilian government | March 11, 2025 | ransomware_live | — |
| airexplore.aero Company | March 11, 2025 | ransomware_live | — |
| mazars.fr | March 10, 2025 | ransomware_live | — |
Page 1 of 2Older →
Claim data from ransomware.live and RansomLook (CC BY 4.0).