Cisco Talos published IOCs ↗
- Evidence class
- provider reported
- Source family label
- Babuk Ranomsware
- Source confidence
- Not reported
- Observed
- 2025-10-14 17:31 UTC
- Retrieved
- 2026-10-08 06:18 UTC
Ransomware galaxy based on https://docs.google.com/spreadsheets/d/1TWS238xacAto-fLKh1n5uTsdijWdCEsGIM0Y0Hvmc5g/pubhtml | Since this is the first detection of this malware in the wild, it’s not surprising that Babuk is not obsfuscated at all. Overall, it’s a pretty standard ransomware that utilizes some of the new techniques we see such as multi-threading encryption as well as abusing the Windows R
2025/10/velociraptor-leveraged-in-ransomware-attacks.jsonNetwork addresses are displayed in defanged form.
No file hashes or network indicators were published in this record.