Overview
Babuk Ransomware is a sophisticated ransomware compiled for several platforms. Windows and ARM for Linux are the most used compiled versions, but ESX and a 32bit old PE executable were observed over time. as well It uses an Elliptic Curve Algorithm (Montgomery Algorithm) to build the encryption keys.
- First tracked: 2020-10-25
- Discussed in our reports: Oman · Qatar · Saudi Arabia
Geography: origin and targets
Assessed origin: Russian Federation. Russian-speaking operators, as reported by vendors; the leaked source code now underpins many other families. Attribution is uncertain: read it as an assessment, not proof.
United States of America3
France1
United Kingdom1
Exploited vulnerabilities
| Vendor | Product | CVE | Category | Source |
|---|---|---|---|---|
| SonicWall | SonicOS SSL-VPN | CVE-2020-5135 | Network edge | coveware.com |
ATT&CK techniques
None recorded in the sources we reviewed.
Tools
- File[.]io
Leak-site infrastructure
| Title | Type | Address (defanged) | Seen online at snapshot |
|---|---|---|---|
| Babuk - Leaks site | DLS | nq4zyac4ukl4tykmidbzgdlvaboqeqsemkp4t35bzvjeve6zm2lqcjid[.]onion | No |
Sources and caveats
Group descriptions, ATT&CK mappings, tools and leak-site locations come from public ransomware tracking projects, including ransomware.live and Crocodyli. Exploited vulnerabilities come from the Ransomware-Vulnerability-Matrix by BushidoUK (licensed CC BY 4.0), supplemented where a group profile there is newer than the data we hold. Each CVE links to its original research source. Technical text is shown in English as published. Leak-site addresses are defanged and shown for blocking and detection; do not visit them. Nothing here is verified by ClairSec_ against a specific incident.
Data snapshot: 2026-10-11