Is Babuk Back? Uncovering the Truth Behind Babuk Locker 2.0
ID: 271348c2-4d72-553e-8154-2fb5999acedd
STIX ID: report--271348c2-4d72-553e-8154-2fb5999acedd
Feed Name: Resources-2
Threat Score
**Executive Summary:** This report analyzes the original Babuk ransomware (2021)—its cross-platform encryptors, aggressive evasion/backup-termination techniques, and the 2021 source-code leak that enabled forks—and exposes the January 2025 "Babuk Locker 2.0" operation as an opportunistic deception: a rebranded LockBit 3.0 payload used by actors (likely Skywave/Bjorka) to perform re-extortion with recycled/stale data rather than a genuine resurgence of the original group.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.