Babuk is a multi-platform ransomware operation targeting Windows and ARM-based Linux systems.
Babuk is a multi-platform ransomware operation primarily targeting Windows and ARM-based Linux systems. It typically compromises internal networks to encrypt critical data. It uses Elliptic Curve Cryptography, specifically the Montgomery Algorithm, to generate encryption keys. Defenders should focus on detecting unusual file encryption activity across both Windows and Linux ESX systems and monitoring initial access vectors.
Babuk Ransomware is a sophisticated ransomware compiled for several platforms. Windows and ARM for Linux are the most used compiled versions, but ESX and a 32bit old PE executable were observed over time. as well It uses an Elliptic Curve Algorithm (Montgomery Algorithm) to build the encryption keys.
Babuk is a multi-platform ransomware operation primarily targeting Windows and ARM-based Linux systems. ESX and an old 32-bit PE executable have also been observed over time.
It uses Elliptic Curve Cryptography, specifically the Montgomery Algorithm, to build the encryption keys.
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.