babyduck
BabyDuck is a ransomware group tracked on ransomware.live with approximately 180 claimed victims, appending the .babyduck extension to encrypted files, distinct from the better-known Babuk group.
source: ransomware.live1 refs →
babyduck
BabyDuck is a ransomware group appending the .babyduck extension to files with roughly 180 claimed victims on ransomware.live.
Analyst brief
BabyDuck is a ransomware group tracked on ransomware.live with around 180 claimed victims, known for appending the .babyduck extension to encrypted files. The group appears to target various sectors without a specific geographic or industry focus provided in the available data. Their main TTP involves file encryption and ransom demands, similar to typical ransomware operations. Defenders should monitor for anomalous file encryption activity, the presence of .babyduck file extensions, and likely initial access vectors such as phishing to detect and prevent potential attacks.
crime
FAQ2
What specific extension is appended to files encrypted by the BabyDuck ransomware?
Encrypted files are appended with the .babyduck extension.
On which platform is the BabyDuck group tracked, and approximately how many victims have they claimed?
The group is tracked on the ransomware.live platform and has claimed around 180 victims.
See also3
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.