The old way: BabLock, new ransomware quietly cruising around Europe, Middle East, and Asia

The report details Group-IB's investigation of the BabLock ransomware, a sophisticated multi-platform (Windows/Linux/ESXi) family used in targeted post‑holiday attacks since mid‑2022; attackers gained initial access via Zimbra RCE (CVE-2022-41352), moved laterally with RDP/Cobalt Strike and GPO deployment, employed DLL side‑loading, anti‑analysis techniques, and encrypted files across hosts and ESXi VMs while leaving extensive IOCs and remediation guidance.