Babuk
Software · ATTACK:enterprise:S0638
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0638",
"title": "Babuk",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0638",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--61c7a91a-0b83-461d-ad32-75d96eed4a09",
"external_id": "S0638",
"domain": "enterprise",
"created": "2021-08-11T17:36:46.197Z",
"modified": "2025-04-25T14:43:34.138Z",
"version": "1.0",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Vasa Locker"
},
{
"source_name": "Babyk"
},
{
"source_name": "Trend Micro Ransomware February 2021",
"url": "https://www.trendmicro.com/en_us/research/21/b/new-in-ransomware.html"
},
{
"source_name": "CyberScoop Babuk February 2021",
"url": "https://www.cyberscoop.com/babuk-ransomware-serco-attack/"
},
{
"source_name": "McAfee Babuk February 2021",
"url": "https://www.mcafee.com/enterprise/en-us/assets/reports/rp-babuk-ransomware.pdf"
},
{
"source_name": "Sogeti CERT ESEC Babuk March 2021",
"url": "https://www.sogeti.com/globalassets/reports/cybersecchronicles_-_babuk.pdf"
}
]
}Explicit source assertions (14)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0638 → uses → ATTACK:enterprise:T1685
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0ae676ca-eb9c-4e3e-b577-22f63b42b7ca
Sogeti CERT ESEC Babuk March 2021ATTACK:enterprise:S0638 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0ffa2b36-2a4c-4f40-af47-c56b357f92c8
McAfee Babuk February 2021ATTACK:enterprise:S0638 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1095b9e8-2849-40c2-b56f-f6bc9d4bc648
Sogeti CERT ESEC Babuk March 2021 · McAfee Babuk February 2021 · Medium Babuk February 2021ATTACK:enterprise:S0638 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--114f4fb4-3c0a-44b0-aeaf-2e2a3ba50fa5
Sogeti CERT ESEC Babuk March 2021 · Medium Babuk February 2021ATTACK:enterprise:S0638 → uses → ATTACK:enterprise:T1486
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--18355c9b-c3e8-4bc7-a389-425e5d7c6351
Sogeti CERT ESEC Babuk March 2021 · McAfee Babuk February 2021 · Medium Babuk February 2021 · Trend Micro Ransomware February 2021ATTACK:enterprise:S0638 → uses → ATTACK:enterprise:T1027.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4cb25ac9-9eb9-47ee-b3f9-53c5a6365c46
Sogeti CERT ESEC Babuk March 2021 · McAfee Babuk February 2021 · Medium Babuk February 2021ATTACK:enterprise:S0638 → uses → ATTACK:enterprise:T1489
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4f5efe16-ce46-4e37-9c9d-d45b14d1ab4c
Sogeti CERT ESEC Babuk March 2021 · McAfee Babuk February 2021 · Trend Micro Ransomware February 2021ATTACK:enterprise:S0638 → uses → ATTACK:enterprise:T1490
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--813370e8-ec26-4533-b8e2-39474edb7006
Sogeti CERT ESEC Babuk March 2021 · McAfee Babuk February 2021ATTACK:enterprise:S0638 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--82066933-1c34-4d79-8e3e-b0e32492cdf0
Sogeti CERT ESEC Babuk March 2021 · McAfee Babuk February 2021ATTACK:enterprise:S0638 → uses → ATTACK:enterprise:T1135
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bba92907-b2fd-4f62-b356-63fab9d714dd
Sogeti CERT ESEC Babuk March 2021ATTACK:enterprise:S0638 → uses → ATTACK:enterprise:T1007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bebaff50-23e0-43d6-ad31-4d84a3b2af73
McAfee Babuk February 2021ATTACK:enterprise:S0638 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cd91751c-a2a2-4626-bb31-b95fd0040818
Sogeti CERT ESEC Babuk March 2021 · McAfee Babuk February 2021 · Trend Micro Ransomware February 2021ATTACK:enterprise:S0638 → uses → ATTACK:enterprise:T1680
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e0140710-f03a-4e43-9e87-45926636b377
McAfee Babuk February 2021ATTACK:enterprise:S0638 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fb819161-4916-4f25-ad81-eab9f02a337e
McAfee Babuk February 2021 · Trend Micro Ransomware February 2021