Babuk Locker Selling Access to High-Profile Targets

In a chilling escalation of cybercrime, the infamous ransomware group Babuk Locker has reportedly begun selling unauthorized access to high-profile government and military systems worldwide.

The alarming revelation surfaced on a Telegram channel allegedly linked to the group, showcasing their ability to infiltrate critical infrastructures across multiple nations.

The exposed systems include government payroll platforms, military web servers, and even national airlines, highlighting the growing sophistication of ransomware operations.

Targets Exposed

The Telegram post listed several compromised systems, including:

• TV Access Control: hxxp://www[.]kvarta[.]net
• Nepal Government Payroll System: hxxp://payroll[.]chauntaramun[.]gov[.]np
• USA Army Web Server: Full access with web shell upload capabilities.
• Iran Air: hxxps://www[.]iranair[.]com
• Turkey Ministry of Education: hxxp://samsungis[.]meb[.]gov[.]tr

These breaches underscore Babuk Locker’s ability to exploit vulnerabilities in diverse sectors, ranging from education and transportation to defense.

Babuk Locker’s Evolution

Babuk Locker emerged in 2021 as a ransomware group targeting enterprises through human-operated attacks. Their tactics evolved rapidly from encrypting files to employing “double extortion.”

In this method, attackers exfiltrate sensitive data before encrypting it, threatening to release the information unless a ransom is paid.

This approach maximizes leverage over victims by adding reputational damage to financial loss.

The group’s encryption techniques are notably robust, utilizing algorithms like ChaCha8 and Elliptic-Curve Diffie–Hellman (ECDH), making unauthorized decryption nearly impossible.

Despite their amateur coding practices, Babuk’s encryption strength has proven effective against numerous organizations.

Babuk Locker 2.0 Affiliate Program

In 2025, Babuk introduced its “Locker 2.0 Affiliate Program,” inviting skilled hackers to join their network.

This program allows affiliates to independently manage negotiations and extortion operations, streamlining ransom payments and maximizing profits.

The affiliate model has expanded Babuk’s reach, enabling them to target more victims globally.

Technical Exploitation Techniques

Babuk’s recent exploits include advanced penetration testing methods and web shell uploads. A web shell is a malicious script that provides attackers with remote access to a server.

By exploiting vulnerabilities such as unrestricted file uploads, cybercriminals can deploy web shells to gain administrative control over compromised systems.

This technique was reportedly used in the breach of the USA Army’s web server, where attackers could upload malicious scripts for persistent access.

Implications for Global Security

The sale of access to critical systems poses significant risks:

1. National Security Threats: Compromised military and government systems could lead to data leaks or sabotage.
2. Economic Impact: Ransomware attacks disrupt operations and incur significant recovery costs.
3. Public Safety Concerns: Breaches in sectors like transportation could endanger lives.

Recommendations for Mitigation

To counter such threats, organizations must adopt robust cybersecurity measures:

• Implement strict access controls and multi-factor authentication.
• Regularly patch software vulnerabilities.
• Monitor network activity for unusual behavior.
• Conduct employee training on phishing and other cyberattack vectors.

Babuk Locker’s latest activities highlight the escalating threat posed by ransomware groups.

Their ability to infiltrate critical systems worldwide underscores the urgent need for enhanced cybersecurity measures.

Governments and organizations must act swiftly to address vulnerabilities and safeguard sensitive information against these increasingly sophisticated attacks.

Also Read: