IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Babuk ransomware returns to target corporate networks

A new version of the Babuk builder has appeared, despite the gang 'retiring' at the end of 2020

Despite signaling that they were getting out of the business, the operators of the Babuk ransomware appear to have lapsed back into old habits with a new attack on corporate networks.

According to a blog post by researchers at Malwarebytes, a new version of the Babuk builder used to create the ransomware’s unique payloads and decryption module has been discovered.

The operators of Babuk last appeared at the end of last year when they attacked Washington DC’s Metropolitan Police Department (MPD) and released the personal data of several MPD officers. However, shortly after that, they announced that their operations had been suspended.

“The Babuk project will be closed, its source code will be made publicly available, we will do something like Open Source RaaS, everyone can make their own product based on our product,” the cyber criminals said at the time.

Last week, however, security researcher Kevin Beaumont discovered the gang's source code on VirusTotal. In a tweet, he said the new version included a builder that would create ransomware for Windows, VMware ESXi virtual machines, and network-attached storage based on x86 and ARM architectures.

Pieter Arntz, a security researcher at Malwarebytes, said that the puzzling question here is why the builder ended up on VirusTotal in the first place. He said that this website is often used as a quick way for interested parties to check whether a file is malicious or not. 

“But it has been a while since malware authors were dunce enough to upload their work to VT to check whether it would be detected by the anti-malware industry or not,” he added.

“The vendors that cooperate on VT have access to any files uploaded there. So, if their freshly created malware was not detected immediately, it would be soon after. Since those days, malware authors have their own services to run these checks without sharing their work with the anti-malware vendors.”

Arntz added that by uploading the builder to VirusTotal, the hackers were basically making the source code available. There were a few possible reasons for doing this. Either someone received or found the file and did not trust it, so they checked it for malware on VT; someone wanted to destroy the Babuk operation by throwing their builder under the (VT) bus: or the Babuk operators chose this as an odd way to make the source code available, according to Arntz.

“Another fact that may be of consequence, somehow, is that researchers found several defects in Babuk’s encryption and decryption code. These flaws show up when an attack involves ESXi servers and they are severe enough to result in a total loss of data for the victim,” said Arntz.

Featured Resources

Accelerating healthcare transformation through patient-centred medtech solutions

Seize the digital transformation opportunities to streamline patient care and optimise patient outcomes

Free Download

Big payoffs from big bets in AI-powered automation

Automation disruptors realise 1.5 x higher revenue growth

Free Download

Hyperscaler cloud service providers top ten

Why it's important for companies to consider hyperscaler cloud service providers, and why they matter

Free Download

Strategic app modernisation drives digital transformation

Address business needs both now and in the future

Free Download

Recommended

Getting board-level buy-in for security strategy
Whitepaper

Getting board-level buy-in for security strategy

30 Nov 2022
Best free malware removal tools 2022
Security

Best free malware removal tools 2022

28 Nov 2022
2022 IBM's Security X-Force cloud threat landscape report
Whitepaper

2022 IBM's Security X-Force cloud threat landscape report

22 Nov 2022
2022 Magic quadrant for Security Information and Event Management (SIEM)
Whitepaper

2022 Magic quadrant for Security Information and Event Management (SIEM)

22 Nov 2022

Most Popular

Empowering employees to truly work anywhere
Sponsored

Empowering employees to truly work anywhere

22 Nov 2022
Salesforce co-CEO Bret Taylor resigns with cryptic parting message
Business operations

Salesforce co-CEO Bret Taylor resigns with cryptic parting message

1 Dec 2022
Netherlands urges citizens to prepare survival kits in case hackers target critical infrastructure
cyber attacks

Netherlands urges citizens to prepare survival kits in case hackers target critical infrastructure

2 Dec 2022