Babuk
Data as of August 16, 2026.
Credential exposure before the attack
37.4% of Babuk victims whose domain we can identify (67 of 179) had employee credentials leak in the 12 months before Babuk named them as a victim.
We don't know whether any of these credentials were how Babuk gained initial access.
What industries Babuk targets
Sector identified for 93 of 179 victims.
| Government | 23 | |
| Healthcare | 15 | |
| Education | 8 | |
| Manufacturing | 8 | |
| Financial Services | 7 | |
| Technology | 7 | |
| Logistics | 5 | |
| Retail | 5 |
Where the victims are located
Country identified for 80 of 179 victims.
| Brazil | 14 | |
| Indonesia | 8 | |
| India | 7 | |
| United States | 4 | |
| China | 4 | |
| Malaysia | 4 | |
| Thailand | 4 | |
| Spain | 3 |
Most recent Babuk victims
| Victim | Sector | Country | Posted |
|---|---|---|---|
| Bangladesh Armed Forces mil.bd | Not identified | Not identified | Apr 4, 2025 |
| Gangotree Homes gangotreehomes.com | Real Estate | Not identified | Apr 4, 2025 |
| Hellenic Air Force haf.gr | Not identified | Greece | Apr 4, 2025 |
| Rheinmetall rheinmetall.com | Manufacturing | Not identified | Apr 4, 2025 |
| Ascires ascires.com | Not identified | Not identified | Apr 3, 2025 |
| DarDoc dardoc.com | Healthcare | Not identified | Apr 3, 2025 |
| ezbuy ezbuy.sg | Retail | Singapore | Apr 3, 2025 |
| ZALORA zalora.sg | Not identified | Singapore | Apr 3, 2025 |
| Uniproof uniproof.com.br | Not identified | Brazil | Apr 2, 2025 |
| Ministry of Health of Rwanda moh.gov.rw | Healthcare | Not identified | Apr 1, 2025 |
| Perusahaan Listrik Negara pln.co.id | Energy | Indonesia | Apr 1, 2025 |
| Atlantic Coast Consulting atlcc.net | Construction | Not identified | Mar 31, 2025 |
| Renault Brune brune.com.br | Not identified | Brazil | Mar 31, 2025 |
| Elsoms Seeds elsoms.com | Not identified | Not identified | Mar 31, 2025 |
| Healthcasts healthcasts.com | Healthcare | Not identified | Mar 31, 2025 |
| Instituto Cardiovascular del Cesar icvc.co | Healthcare | Colombia | Mar 31, 2025 |
| Ferramenta La Futura Srl lafuturasrl.it | Construction | Italy | Mar 31, 2025 |
| Leadzen.ai leadzen.ai | Not identified | Not identified | Mar 31, 2025 |
| Modiin Ezrachi modiin-ezrachi.co.il | Not identified | Israel | Mar 31, 2025 |
| Pure Incubation pureincubation.com | Not identified | Not identified | Mar 31, 2025 |
Showing the 20 most recent of 179. Browse recent data breaches for more.
Babuk leak sites
Addresses we've seen Babuk publish victims from. Any .onion address needs the Tor Browser.
bxwu33iefqfc3rxigynn3ghvq4gdw3gxgxna5m4aa3o4vscdeeqhiqad.oniongofile.io7dikawx73goypgfi4zyo5fcajxwb7agemmiwqax3p54aey4dwobcvcyd.onionfastupload.ioxeuvs5poflczn5i5kbynb5rupmidb5zjuza6gaq22uqsdp3jvkjkciqd.onionpixeldrain.comgtmx56k4hutn3ikv.onionmega.nzarch1.111mmde-s3d2.comanonfiles.combayfiles.comfiles.waifu.catanonymfile.comstore4.gofile.iopastebin.comarch2.111tyxzc-632.comfine-download.com
Babuk questions
Is Babuk still active?
Not for over a year. The last victim we recorded was April 4, 2025. The leak site has published nothing since, though the data it already leaked is still out there.
How many victims has Babuk claimed?
Babuk has named 179 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files.
When did Babuk first appear?
The first victim we recorded for Babuk was posted on January 28, 2025. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does Babuk target?
Government accounts for the most victims we can classify, with 23. Healthcare follows at 15. We could identify a sector for 93 of 179 victims, so treat this as the shape of the targeting rather than a full census.
Has Babuk already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.