Hide Navigation Hide TOC

Babuk - S0638 (61c7a91a-0b83-461d-ad32-75d96eed4a09)

Babuk is a Ransomware-as-a-service (RaaS) malware that has been used since at least 2021. The operators of Babuk employ a "Big Game Hunting" approach to targeting major enterprises and operate a leak site to post stolen data as part of their extortion scheme.(Citation: Sogeti CERT ESEC Babuk March 2021)(Citation: McAfee Babuk February 2021)(Citation: CyberScoop Babuk February 2021)

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
System Information Discovery - T1082 (354a7f88-63fb-41b5-a801-ce3b377b36f1)	Attack Pattern	Babuk - S0638 (61c7a91a-0b83-461d-ad32-75d96eed4a09)	Malware	1
Babuk - S0638 (61c7a91a-0b83-461d-ad32-75d96eed4a09)	Malware	Network Share Discovery - T1135 (3489cfc5-640f-4bb3-a103-9137b97de79f)	Attack Pattern	1
Babuk - S0638 (61c7a91a-0b83-461d-ad32-75d96eed4a09)	Malware	Inhibit System Recovery - T1490 (f5d8eed6-48a9-4cdf-a3d7-d1ffa99c3d2a)	Attack Pattern	1
Babuk - S0638 (61c7a91a-0b83-461d-ad32-75d96eed4a09)	Malware	System Network Connections Discovery - T1049 (7e150503-88e7-4861-866b-ff1ac82c4475)	Attack Pattern	1
Deobfuscate/Decode Files or Information - T1140 (3ccef7ae-cb5e-48f6-8302-897105fbf55c)	Attack Pattern	Babuk - S0638 (61c7a91a-0b83-461d-ad32-75d96eed4a09)	Malware	1
Software Packing - T1027.002 (deb98323-e13f-4b0c-8d94-175379069062)	Attack Pattern	Babuk - S0638 (61c7a91a-0b83-461d-ad32-75d96eed4a09)	Malware	1
Babuk - S0638 (61c7a91a-0b83-461d-ad32-75d96eed4a09)	Malware	File and Directory Discovery - T1083 (7bc57495-ea59-4380-be31-a64af124ef18)	Attack Pattern	1
Babuk - S0638 (61c7a91a-0b83-461d-ad32-75d96eed4a09)	Malware	Disable or Modify Tools - T1562.001 (ac08589e-ee59-4935-8667-d845e38fe579)	Attack Pattern	1
Babuk - S0638 (61c7a91a-0b83-461d-ad32-75d96eed4a09)	Malware	System Service Discovery - T1007 (322bad5a-1c49-4d23-ab79-76d641794afa)	Attack Pattern	1
Native API - T1106 (391d824f-0ef1-47a0-b0ee-c59a75e27670)	Attack Pattern	Babuk - S0638 (61c7a91a-0b83-461d-ad32-75d96eed4a09)	Malware	1
Babuk - S0638 (61c7a91a-0b83-461d-ad32-75d96eed4a09)	Malware	Windows Command Shell - T1059.003 (d1fcf083-a721-4223-aedf-bf8960798d62)	Attack Pattern	1
Process Discovery - T1057 (8f4a33ec-8b1f-4b80-a2f6-642b2e479580)	Attack Pattern	Babuk - S0638 (61c7a91a-0b83-461d-ad32-75d96eed4a09)	Malware	1
Babuk - S0638 (61c7a91a-0b83-461d-ad32-75d96eed4a09)	Malware	Data Encrypted for Impact - T1486 (b80d107d-fa0d-4b60-9684-b0433e8bdba0)	Attack Pattern	1
Babuk - S0638 (61c7a91a-0b83-461d-ad32-75d96eed4a09)	Malware	Service Stop - T1489 (20fb2507-d71c-455d-9b6d-6104461cf26b)	Attack Pattern	1
Obfuscated Files or Information - T1027 (b3d682b6-98f2-4fb0-aa3b-b4df007ca70a)	Attack Pattern	Software Packing - T1027.002 (deb98323-e13f-4b0c-8d94-175379069062)	Attack Pattern	2
Disable or Modify Tools - T1562.001 (ac08589e-ee59-4935-8667-d845e38fe579)	Attack Pattern	Impair Defenses - T1562 (3d333250-30e4-4a82-9edc-756c68afc529)	Attack Pattern	2
Windows Command Shell - T1059.003 (d1fcf083-a721-4223-aedf-bf8960798d62)	Attack Pattern	Command and Scripting Interpreter - T1059 (7385dfaf-6886-4229-9ecd-6fd678040830)	Attack Pattern	2