Babuk2, also known as Satanlock, is a financially motivated actor who impersonates the Babuk Ransomware group and fabricates attacks from public data leaks.
Babuk2, also known as Satanlock, is a financially motivated cybercriminal who impersonates the Babuk Ransomware group after failing to profit from selling stolen data. He primarily targets victims by claiming responsibility for public database breaches from forums like BreachForums and presenting them as ransomware attacks on his blog. The main TTPs involve brand impersonation and the repurposing of publicly available leak data to fabricate attack narratives. Defenders should focus on verifying the authenticity of any claimed breach against known public leak databases before escalating response efforts.
Babuk Locker 2.0, also known as Bjorka or SkyWave, after failing to make any profit from selling public databases on forums, decided to impersonate Babuk Ransomware group. He launched a blog where he claimed multiple public breaches from BreachForums as ransomware attacks
Babuk2, also known as Satanlock, is a financially motivated cybercriminal who impersonates the Babuk Ransomware group. His main TTPs involve brand impersonation and repurposing public database breaches from forums like BreachForums, presenting them as ransomware attacks on his blog.
Defenders should be cautious of Babuk2's 'recycled' claims and must accurately verify whether an actual data breach occurred by checking against known public leak databases before escalating response efforts.
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.