--- title: "Threat analysis: Babuk ransomware" description: Babuk ransomware is a sophisticated cyberthreat that’s actively targeting high-value organizations and leaking data publicly if the ransom isn’t paid. Learn how this piece of malware operates, and how Acronis’ cyber protection solutions can keep your data and applications safe. canonical_url: https://www.acronis.com/en/blog/posts/babuk-ransomware/ locale: en last_updated: 2026-10-27 --- [Acronis Blog](https://www.acronis.com/en/blog/) # Threat analysis: Babuk ransomware On May 13, 2021, the Babuk authors published 250 GB of data stolen from the Washington D.C. Police Department, suggesting that their ransom demands were not met. [Try Now](https://www.acronis.com/en/products/cloud/trial/) [![Image 2: Acronis Editorial Team](https://staticfiles.acronis.com/images/content/d85707ae91461544212d39836dc32b42.png)](https://www.acronis.com/en/blog/authors/acronis/ "Acronis Editorial Team") [Acronis Editorial Team](https://www.acronis.com/en/blog/authors/acronis/) 3 min read Last updated 02 December 2022 ## Summary * Responsible for attacks on at least five major organizations, including the recently compromised Washington D.C. Police Department * Targets victims on both Windows and Linux platforms * The Babuk gang claims that their attacks are a ‘security audit’ of corporate networks, and after successful strikes they request payment for their ‘services’ * The group is currently targeting the transportation, healthcare, plastic surgery, electronics, and agricultural sectors across multiple geographies * They do not attack hospitals, non-profit foundations, schools (except for major universities), or SMBs with annual revenue of less than $4 million * For file encryption, HC-128/ChaCha8 symmetric encryption algorithms are used * For file key encryption, Elliptic-curve Diffie–Hellman (ECDH) is used, which makes it impossible to get the file key for decryption without the private key owned by criminals * Recently, the Babuk group claimed that they are going to quite RaaS cryptolocking and focus on data-theft extortion On May 13, 2021, the Babuk authors published 250 GB of data stolen from the Washington D.C. Police Department, suggesting that their ransom demands were not met. ## Attack vectors The Babuk group hires hackers with knowledge of pentesting tools — including winPEAS, Bloodhound, and SharpHound — or hacking frameworks such as CobaltStrike, Metasploit, Empire, or Covenant to run targeted attacks on big enterprises. ## Execution To check its running copies, Babuk sets a mutex named ‘DoYouWantToHaveSexWithCuongDong’. This is a reference to the researcher [Chuong Dong](https://twitter.com/cPeterr), who analyzed previous versions of the Babuk ransomware. Babuk terminates the following processes of databases and office applications to release files for encryption: _sql.exe, oracle.exe, ocssd.exe, dbsnmp.exe, synctime.exe, agntsvc.exe, isqlplussvc.exe, xfssvccon.exe, mydesktopservice.exe, ocautoupds.exe, encsvc.exe, firefox.exe, tbirdconfig.exe, mydesktopqos.exe, ocomm.exe, dbeng50.exe, sqbcoreservice.exe, excel.exe, infopath.exe, msaccess.exe, mspub.exe, onenote.exe, outlook.exe, powerpnt.exe, steam.exe, thebat.exe, thunderbird.exe, visio.exe, winword.exe, wordpad.exe, notepad.exe_ The ransomware stops the following backup and anti-malware services: _vss_ _sql_ _svc$_ _memtas_ _mepocs_ _sophos_ _veeam_ _backup_ _GxVss_ _GxBlr_ _GxFWD_ _GxCVD_ _GxCIMgr_ _DefWatch_ _ccEvtMgr_ _ccSetMgr_ _SavRoam_ _RTVscan_ _QBFCService_ _QBIDPService_ _Intuit.QuickBooks.FCS_ _QBCFMonitorService_ _YooBackup_ _YooIT_ _zhudongfangyu_ _sophos_ _stc\_raw\_agent_ _VSNAPVSS_ _VeeamTransportSvc_ _VeeamDeploymentService_ _VeeamNFSSvc_ _veeam_ _PDVFSService_ _BackupExecVSSProvider_ _BackupExecAgentAccelerator_ _BackupExecAgentBrowser_ _BackupExecDiveciMediaService_ _BackupExecJobEngine_ _BackupExecManagementService_ _BackupExecRPCService_ _AcrSch2Svc_ _AcronisAgent_ _CASAD2DWebSvc_ _CAARCUpdateSvc_ Babuk skips the following files and folders: _AppData_ _Boot_ _Windows_ _Windows.old_ _Tor Browser_ _Internet Explorer_ _Google_ _Opera_ _Opera_ _Software_ _Mozilla_ _Mozilla_ _Firefox_ _$Recycle.Bin_ _ProgramData_ _All Users_ _autorun.inf_ _boot.ini_ _bootfont.bin_ _bootsect.bak_ _bootmgr_ _bootmgr.efi_ _bootmgfw.efi_ _desktop.ini_ _iconcache.db_ _ntldr_ _ntuser.dat_ _ntuser.dat.log_ _ntuser.ini_ _thumbs.db_ _Program Files_ _Program Files (x86)_ It also deletes shadow copies of files: _cmd.exe /c vssadmin.exe delete shadows /all /quiet_ ## File encryption The latest version of Babuk has switched to the HC-128 algorithm from ChaCha8 for file encryption. For file key encryption, the Elliptic-curve Diffie–Hellman (ECDH) scheme is used. The authors changed the elliptic curve from a Weierstrass curve K-571 to the more common Curve25519 for better performance. Unfortunately, it’s impossible to get the file key for decryption without the private key, which is known only to the cybercriminals. The ransomware adds a ‘.babyk’ extension to the encrypted files. Babuk adds the following message at the end of the encrypted files: _“choung dong looks like hot dog!!”_ ## Ransom note The ransom note contains contact information and links demonstrating proof of the attack through the Tor network. Victims are encouraged to click through for more information about their stolen data and how to pay for its decryption. ## Data leak site Babuk’s data leak site provides information about the group’s activities and preferred targets. ## Detection by Acronis Acronis’ Active Protection technology uses advanced, AI-driven behavioral analysis to successfully identify and stop Babuk attacks — as well as any other known or unknown cyberthreats. Backups are protected against tampering, and enable the automatic and rapid restoration of any encrypted files. ## Conclusion The Babuk ransomware employs an unbreakable encryption scheme that makes it impossible to recover files without a decryptor. According to information published on the data leak site, Babuk’s code has been given to another criminal group and will appear again under another name. The Babuk group will continue its criminal business with hacking and data exfiltration only. ## IoCs SHA256: 391cfcd153881743556f76de7bbca5b19857f8b69a6f6f6dfde6fd9b06c17f5e babuk.bin Mutex: DoYouWantToHaveSexWithCuongDong [Ransomware protection](https://www.acronis.com/en/blog/tags/ransomware-protection/) [MSP cybersecurity](https://www.acronis.com/en/blog/tags/msp-cybersecurity/) ## Written by ![Image 3: Acronis Editorial Team](https://staticfiles.acronis.com/images/content/d85707ae91461544212d39836dc32b42.png) Acronis Editorial Team Acronis is a global cyber protection company that provides natively integrated cybersecurity, data protection, and endpoint management for managed service providers (MSPs), small and medium businesses (SMBs), and enterprise IT departments. [Previous post](https://www.acronis.com/en/blog/posts/n3tw0rm-ransomware/) [Threat analysis: N3tw0rm ransomware](https://www.acronis.com/en/blog/posts/n3tw0rm-ransomware/) [Next post](https://www.acronis.com/en/blog/posts/revil-ransomware-supply-chain-attack-against-msps/) [REvil ransomware supply chain attack against MSPs](https://www.acronis.com/en/blog/posts/revil-ransomware-supply-chain-attack-against-msps/) About Acronis Acronis is a leader in AI-native cyber protection, unifying data protection, cybersecurity, IT operations and hybrid infrastructure to deliver business continuity, security and compliance with less cost and complexity. More than 21,000 service providers trust Acronis to protect over 750,000 businesses in 150 countries. Acronis is headquartered in Schaffhausen, Switzerland. [Add as a preferred source on Google](https://google.com/preferences/source?q=acronis.com) ## Related stories Want to learn more? Read the latest stories featuring this solution on our blog. [Acronis Blog](https://www.acronis.com/en/blog/) ![Image 4: stc Bahrain and Acronis partner to bring advanced endpoint security to businesses in Bahrain](https://staticfiles.acronis.com/images/blog-card/9600f3eea83b8f4e168ea6c1409c8c26.png) [stc Bahrain and Acronis partner to bring advanced endpoint security to businesses in Bahrain](https://www.acronis.com/en/blog/posts/stc-bahrain-and-acronis-partner-to-bring-endpoint-security-to-businesses/) We are proud to announce a strategic partnership with stc Bahrain, expanding access to advanced cybersecurity services for businesses across Bahrain. **October 26, 2026**3 min read ![Image 5: Acronis expands MDR toward broader workspace protection](https://staticfiles.acronis.com/images/blog-card/18e90e89f5ec4ef0901f19008d4ccbf2.png) [Acronis expands MDR toward broader workspace protection](https://www.acronis.com/en/blog/posts/acronis-expands-mdr-toward-broader-workspace-protection/) Acronis is expanding the MDR service with capabilities that make this expertise easier to deliver and help partners address more risks. The developments build on a broader commitment to managed security: helping service providers protect the connected workspace while giving customers access to the expertise needed to investigate threats, respond effectively and maintain business continuity. **October 13, 2026**6 min read ![Image 6: Acronis Cyber Protect v17: Improving cyber resilience across people, data and infrastructure](https://staticfiles.acronis.com/images/blog-card/c2467c28c0278609eb3560cb2a8a4d53.png) [Acronis Cyber Protect v17: Improving cyber resilience across people, data and infrastructure](https://www.acronis.com/en/blog/posts/acronis-cyber-protect-v17-improving-cyber-resilience-across-people-data-and-infrastructure/) Acronis Cyber Protect v17 Q3 2026 expands integrated cyber protection with new capabilities that strengthen security awareness, improve backup operations and extend protection across more virtual environments. The result is stronger cyber resilience, simplified operations and broader protection delivered through a single platform. **October 05, 2026**4 min read