// THREAT ACTOR
BABUK-BJORKA_
DormantBABUK-BJORKA is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem — file encryption combined with the threat of stolen-data publication on a public leak site — and continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of BABUK-BJORKA — incident write-ups, attribution notes, and additional context — see the Threat Groups archive or run a site search.
213
Victims tracked
0 / 6
Active mirrors
2025-01-27
First listing
2025-04-04
Most recent
Victims by year
- 2025 213
Leak site mirrors
6 mirrors tracked, 0 currently reachable. These are criminal-infrastructure URLs — links are deliberately not provided.
-
7dikawx73goypgfi4zyo5fcajxwb7agemmiwqax3p54aey4dwobcvcyd.onionBabuk - Leaks site snapshot · 2025-01-29 16:24 -
gtmx56k4hutn3ikv.onionsnapshot · 2025-01-27 16:32 -
xeuvs5poflczn5i5kbynb5rupmidb5zjuza6gaq22uqsdp3jvkjkciqd.onionsnapshot · 2025-04-02 17:13 -
fpwwt67hm3mkt6hdavkfyqi42oo3vkaggvjj4kxdr2ivsbzyka5yr2qd.onionsnapshot · 2025-01-27 17:00 -
57mphyfkxoj5lph2unswd23akewz3jtj7mb6wignwmyto32ghp2visid.onionOnionShare snapshot · 2025-01-28 15:16 -
bxwu33iefqfc3rxigynn3ghvq4gdw3gxgxna5m4aa3o4vscdeeqhiqad.onionBabuk - Leaks site snapshot · 2025-04-04 18:15
Recent victims
The 50 most recent victims claimed by BABUK-BJORKA. Total in the index: 213.
| Date listed | Victim | Description |
|---|---|---|
| 2025-04-04 | rheinmetall.com (Rheinmetall Defence) | rheinmetall.com (Rheinmetall Defence) |
| 2025-04-04 | Secret plans of Indian army | Secret plans of Indian army |
| 2025-04-04 | Bangladesh Armed Forces (BangLadesh Army) | Bangladesh Armed Forces (BangLadesh Army) |
| 2025-04-04 | Saudi Arabian military and government internal center | Saudi Arabian military and government internal center |
| 2025-04-04 | Hellenic Airforce | Hellenic Airforce |
| 2025-04-04 | turkish defense military | turkish defense military |
| 2025-04-03 | gangotreehomes.com (RealEstate) | gangotreehomes.com (RealEstate) |
| 2025-04-03 | Iran gas service system | Iran gas service system, |
| 2025-04-03 | kfar hatta medical center - Lebanon | kfar hatta medical center - Lebanon |
| 2025-04-03 | Polizia italia mail access | Polizia italia mail access |
| 2025-04-03 | zalora.sg (Singapore Shopping) | zalora.sg (Singapore Shopping) |
| 2025-04-03 | ezbuy.sg (Singapore Shopping) | ezbuy.sg (Singapore Shopping) |
| 2025-04-02 | dardoc.com | dardoc.com |
| 2025-04-02 | navy-mil-bd | navy-mil-bd |
| 2025-04-02 | ascires.com | ascires.com |
| 2025-04-02 | aosense.com - AO Sense INC. | aosense.com - AO Sense INC. |
| 2025-04-02 | drdo.gov.in | drdo.gov.in |
| 2025-04-01 | uniproof.com.br | uniproof.com.br |
| 2025-04-01 | (UPDATE) - whitecapcanada.com | (UPDATE) - whitecapcanada.com |
| 2025-03-31 | moh.gov.rw | moh.gov.rw |
| 2025-03-31 | pln.co.id - PLN INDONESIA | pln.co.id - PLN INDONESIA |
| 2025-03-29 | iDRAC (Integrated Dell Remote Access Controller) management interface for Dell servers | iDRAC (Integrated Dell Remote Access Controller) management interface … |
| 2025-03-29 | elsoms.com | elsoms.com |
| 2025-03-29 | brune.com.br - Group MC (conglomerate) | brune.com.br - Group MC (conglomerate) |
| 2025-03-29 | towellengineering.net | towellengineering.net |
| 2025-03-29 | icvc.co - Instituto Cardiovascular del Cesar | icvc.co - Instituto Cardiovascular del Cesar |
| 2025-03-29 | modiin-ezrachi.co.il | modiin-ezrachi.co.il |
| 2025-03-29 | La Futura | La Futura |
| 2025-03-29 | Atlantic Coast Consulting Inc | Atlantic Coast Consulting Inc |
| 2025-03-29 | theeyeclinicsurgicenter.com - The Eye Clinic Surgicenter company | theeyeclinicsurgicenter.com - The Eye Clinic Surgicenter company |
| 2025-03-28 | 🚀 Launch Your Own Ransomware(RAAS) Business with Our Exclusive Ransomware Panel Source Cod | 🚀 Launch Your Own Ransomware(RAAS) Business with Our Exclusive Ransomw… |
| 2025-03-28 | healthcasts.com | healthcasts.com |
| 2025-03-28 | pureincubation.com | pureincubation.com |
| 2025-03-28 | leadzen.ai | leadzen.ai |
| 2025-03-28 | unired.uz | unired.uz |
| 2025-03-27 | nadra.gov.pk - NADRA official Of Pakistan Army & (Andhra Pradesh) | nadra.gov.pk - NADRA official Of Pakistan Army & (Andhra Pradesh) |
| 2025-03-27 | nadra.gov.pk - NADRA official Of Pakistan Army | nadra.gov.pk - NADRA official Of Pakistan Army |
| 2025-03-26 | aman-iraq.com | aman-iraq.com |
| 2025-03-26 | heras.co.uk | heras.co.uk |
| 2025-03-26 | alliedwoundcare.com | alliedwoundcare.com |
| 2025-03-26 | crimsgroup.com | crimsgroup.com |
| 2025-03-26 | mot.gov.iq - Iraqi Ministry of Commerce (Of Trade) | mot.gov.iq - Iraqi Ministry of Commerce (Of Trade) |
| 2025-03-26 | israel Infrastructure & Secret Documents intelligence information | israel Infrastructure & Secret Documents intelligence information |
| 2025-03-25 | kalesavunma.com - KALE SAVUNMA. | kalesavunma.com - KALE SAVUNMA. |
| 2025-03-24 | airexplore.aero | airexplore.aero |
| 2025-03-24 | iberdrola.com (Spain energy) | iberdrola.com (Spain energy) |
| 2025-03-22 | let's join us babuk locker (Ransomare Affiliate) 2025 | let's join us babuk locker (Ransomare Affiliate) 2025 |
| 2025-03-22 | inmarsat.com | inmarsat.com |
| 2025-03-22 | jp-property.com | jp-property.com |
| 2025-03-22 | Synesis Surveillance System | Synesis Surveillance System |