Access Panel Financial Technology Company (Thailand) targeted by Babuk2

• Ransomware group: Babuk2
• Country: Thailand
• Sector: Technology
• Announcement date: March 19, 2025

Babuk2 claims to have compromised Access Panel Financial Technology Company

The threat actor known as Babuk2 has announced a new victim on its leak site. The group claims to have obtained unauthorized access to a web panel belonging to the Access Panel Financial Technology Company, a firm based in Thailand. According to the announcement made on March 19, 2025, the attackers are attempting to sell the access credentials they have acquired.

Ransomware groups often utilize leak sites to pressure victims into paying ransoms. This tactic is a core component of double extortion, where attackers not only encrypt an organization's data but also threaten to publish sensitive information if the ransom is not met. By listing a victim publicly, these groups aim to maximize the reputational damage and pressure the target into compliance.

Details of the claimed attack and ransom demand

The Babuk2 group stated that they have successfully obtained access to a worker account belonging to the institution. While the attackers have clarified that this specific access does not include administrative privileges, they assert that the account provides entry into a web panel. The claim was made on the same day it was announced, March 19, 2025.

In the announcement, the group has set a specific price for the access they are offering. They are requesting a ransom demand of 12,000 dollars to hand over the credentials. The group's public profile and the specific details surrounding their operations remain limited, making it difficult to gather extensive public information regarding their broader infrastructure or previous activities.

Data and credentials involved in the leak

The announcement indicates that the compromised information includes access credentials for the financial technology company's web panel. Furthermore, the group alleges that the access may provide them with sensitive information pertaining to the residents of Thailand. Specifically, the listing mentions the following types of affected data:

• Loan data
• Employee access credentials

The presence of such data in a leak listing highlights the high stakes involved in financial technology breaches. When employee credentials are leaked, it provides a foothold for further unauthorized movement within a network. When sensitive financial information is involved, the implications for the individuals whose data is exposed are significant.

Implications and organizational risks

This situation suggests that unauthorized access to the institution's internal systems may have occurred. Such an event can lead to several cascading risks for the organization and its clients. For the company, the exposure of personal data could lead to administrative and legal sanctions under Thai financial regulations and data protection laws. The unauthorized access may also allow third parties to infiltrate the institution's systems more deeply or conduct targeted phishing attacks against employees or customers.

For the customers, the leakage of financial data may increase the risk of identity theft and fraud. When personal financial details are available to malicious actors, it facilitates more convincing social engineering attacks and fraudulent activities.

To mitigate such risks, organizations in the technology and financial sectors typically focus on several defensive strategies. Implementing multi-factor authentication (MFA) is a critical step to prevent unauthorized access via stolen worker credentials. Additionally, strict identity and access management (IAM) protocols can ensure that even if a worker account is compromised, the attacker does not gain excessive privileges. Regular monitoring of system logs and implementing robust encryption for sensitive data can also help detect and minimize the impact of a potential breach.