The group behind the Babyk ransomwarehas created a new website that was used to publish the stolen data of its victims as part of a double blackmail tactic. However, the website also lists those who are not its targets, with some interesting exceptions.
Following in the footsteps of Maze ransomware, which introduced a new double extortion strategy in 2019, Babyk Ransomware threatens to publish the stolen data if the victim does not pay the ransom.
Other ransomware gangs have adopted this strategy, making it a popular method for malicious actors.
Babyk ransomware, also known as Babuk, is a new ransomware operation that began earlier this year and is targeting corporate organizations worldwide.
When it first started, the ransomware gang leaked organizations' data in posts on the hacking forum "Raid Forums," but stated that it planned to create a dedicated website for leaks .
Emsisoft security researcher Brett Callow shared the new website recently created by the Babyk Ransomware group, which currently lists four victims and has leaked data for three of them.
The data leak website also includes a list of organizations that hackers, which includes hospitals, non-profits, schools, and small businesses.
For each of these categories, however, the ransomware gang lists the following exceptions:
We do not target the following categories of organizations:
- Hospitals: except for private plastic surgery clinics, private dental clinics
- Nonprofit Organization: Any non-profit charitable foundation (except foundations that help the LGBT and BLM communities)
- Schools: except for major universities
- Small Businesses: Companies with annual revenue under $4 million (revenue information we receive from zoominfo)
There has been an exception in the past for healthcare and what ransomware gangs call “vital” services, such as 911, shelters, and nursing homes.
However, the decision to target charities that support certain groups of individuals is something that does not happen often and raises questions about the mindsets and perceptions of malicious actors.
