Babuk

Babuk was a financially motivated ransomware operation and malware family that emerged publicly at the turn of 2020–2021 and quickly adopted a big-game-hunting and double-extortion model. U.S. Department of Justice reporting states that the Babuk variant first appeared around December 2020 and that Babuk actors executed more than 65 attacks worldwide, issuing more than USD 49 million in ransom demands and receiving as much as USD 13 million in payments. The operation combined encryption with theft and threatened publication of victim data through dedicated leak infrastructure.

The most firmly documented Babuk incident is the April 2021 compromise of the Metropolitan Police Department of Washington, D.C. U.S. authorities allege that Babuk conspirators deployed the ransomware, stole data and attempted to extort the department by threatening disclosure. The incident materially increased law-enforcement pressure on the operation and preceded a rapid sequence of business-model changes, infrastructure repurposing and internal fragmentation.

Babuk's malware was technically significant despite uneven implementation quality. Windows builds documented in early 2021 supported local and network-share encryption, terminated processes and services that could interfere with encryption, enumerated network resources, deleted Windows shadow copies and used victim-specific ransom artefacts. The operation also developed Linux/VMware ESXi-oriented tooling; independent analysis found serious defects in the ESXi encryptor/decryptor that could cause repeated encryption or destruction of files during attempted recovery.

Babuk's long-term significance now derives more from its leaked tooling than from continuing activity by the original operation. A builder leaked in mid-2021 and full source code was released in September 2021, enabling multiple independent ransomware families and actors to reuse Babuk code, especially for ESXi lockers. Those descendants are a code-lineage risk, not evidence of continued Babuk control. Current reporting on entities styling themselves “Babuk 2” or “Babuk Locker 2.0” does not establish a revival of the original operation; 2025 technical analysis found at least one such promoted sample to be LockBit 3.0 code under Babuk branding.

INFERENCE (confidence: high): As of the 2026-09-15 collection cutoff, the original Babuk operation is best treated as historical/dormant rather than an active contemporary RaaS brand. Its enduring defensive relevance comes from the malware's observable behaviors, still-useful historical indicators, the continuing legal pursuit of an alleged administrator/developer, and widespread downstream reuse of leaked Babuk code.