Campaigns / Malware / Family

Babuk

Babuk is a Ransomware-as-a-service (RaaS) malware that has been used since at least 2021.

13New IOCs · 24h

20New IOCs · 7 days

20Indicators tracked

1Independent feeds

2026-10-12 08:46Last activity

New indicators per day

2026-09-29 to 2026-10-12, by first report.

Hash20
Malware20

MITRE ATT&CK lists this as malware Babuk. Explore the ATT&CK matrix →

Where its infrastructure is hosted

No location data.

Latest indicators

Filter the live feed →

First seen	Type	Indicator	Role	Where
2026-10-12 08:46	SHA256	74c3bfe24d829f5ca6c6f80131f97b823ed01538fd327009487c6b48d3f88364	Malware sample	—
2026-10-12 03:30	SHA256	796e146c8ab0b347be05f2dff2a2126e95450baa8231cab37d613781c5f4e531	Malware sample	—
2026-10-12 02:30	SHA256	28650bfd166ec0ab3475621dfb1043fcf279829607f98080785b8cd821e69512	Malware sample	—
2026-10-12 02:30	SHA256	3005119ced0d1c4bb56875489449c56bf8b78f2e03e0bc061b11763bc2a66d76	Malware sample	—
2026-10-12 02:18	SHA256	12e2ca2b38d979d5ac273b8541b6dd39859af1f25b0ad5f365965d43cc9e8617	Malware sample	—
2026-10-11 17:07	SHA256	1def60d2c4f2128ec5bc32cbf4a8fb78fadce9544647333e3bfc59c67cfc5808	Malware sample	—
2026-10-11 17:07	SHA256	35ac519a20d5647cfd174483153836f3ed1918c19c463fcc64b4f48b16371403	Malware sample	—
2026-10-11 14:59	SHA256	9ca40b7209680bc028cffac1ed8c42469df5a297b5b42537fdd2b82969aa55de	Malware sample	—
2026-10-11 14:43	SHA256	ccff031914026b2c36eacb1dc0e01e90cc4f417c83c0f1b62ab6741ef28ec17c	Malware sample	—
2026-10-11 14:27	SHA256	279f261dde8c93b10f584978c3773eec878d5252ea57536cb0d72f069f9e4cc7	Malware sample	—
2026-10-11 14:27	SHA256	815adc496bc9d2778caf13bc338d05a062b275abcb3c8e6aaed86d89d41f1432	Malware sample	—
2026-10-11 13:02	SHA256	a46f5b359f3740b78e890f269ce69744c1fd6a4a5cfebeda0cda78c511bbd9e9	Malware sample	—
2026-10-11 12:44	SHA256	f67690d1fd39e1382a5e5841509b700547d088ee69e0f116b43472796daf33af	Malware sample	—
2026-10-10 14:41	SHA256	8652f46b6188f33ff94354d2b7c97063f0a19f22f168593bab9f0c7bcac88fb4	Malware sample	—
2026-10-10 13:40	SHA256	0b10fdcd16eb63f2fbbe38dc94a7695f0831fe5c8e19ce1b8f4977c7bd10add1	Malware sample	—
2026-10-10 12:40	SHA256	04a458e1aaffcbaca965b2896d2d8767d41ff6397f4f53648194c61ba65b2491	Malware sample	—
2026-10-09 10:06	SHA256	6cfeff6064cde02795275cb35e8af7ee1391a17d9ad6ce624bd7b7fb554d520a	Malware sample	—
2026-10-09 08:04	SHA256	0d484719538bee855faa9e8f3c7576bc6aefec231cef2602ddb77ea4c77216ce	Malware sample	—
2026-10-09 07:31	SHA256	2c508854c7699c98c98c6c51a5372e7a60a39d5379069f6b7464a76dd511c2f9	Malware sample	—
2026-10-09 07:31	SHA256	35d18770f9ba31eac386289ebc73e885e48cf418e0aef136f6fcea0d3f87f8ad	Malware sample	—

Defanged for safety. URL query strings removed.

New indicators per day

Where its infrastructure is hosted

Latest indicators

Security check