Airexplore.aero Company targeted by babuk2 ransomware group

• Ransomware group: babuk2
• Country: Slovakia
• Sector: Transportation
• Announcement date: March 11, 2025

The ransomware group known as babuk2 has officially listed the Slovakian charter airline airexplore.aero Company on its leak site. The threat actors claim to have successfully exfiltrated a significant volume of sensitive information from the organization's systems, marking a targeted attack against the transportation sector.

The claimed attack and data leak

According to the announcement published on March 11, 2025, the babuk2 group claims to have obtained a dataset consisting of approximately 4 GB of data. This breach involves a total of 1,136 files that the group asserts were taken directly from the organization's internal systems. The announcement was made on the same day the group claims the attack occurred.

To support their claims, the threat actors provided screenshots as evidence of the breach. These images appear to display various technical documents and maintenance manuals specifically related to the aviation industry. This type of evidence is commonly used by ransomware groups to demonstrate the validity of their intrusion and to pressure the victim into meeting their demands.

Details of the compromised data

The leaked information appears to be highly specialized, focusing on the technical and operational aspects of aircraft maintenance and flight procedures. Based on the screenshots provided in the leak announcement, the stolen data includes critical documentation for the Boeing 737 series. Specifically, the group claims to have accessed the following types of files:

• Technical maintenance manuals
• Aviation operation documents

More specifically, the documentation includes highly technical manuals such as the Aircraft Maintenance Manual (AMM), Fault Isolation Manual (FIM), Aircraft Illustrated Parts Catalog (AIPC), Standard Service Manual (SSM), and the Structural Repair Manual (SWPM). Additionally, the data set reportedly contains technical modification documents and various other manuals essential for aviation operations.

About airexplore.aero Company

AirExplore is a charter airline based in Slovakia. The company provides passenger and cargo transportation services worldwide, operating within the highly regulated and safety-critical transportation sector.

Implications and industry context

The leakage of such detailed technical documentation may have significant consequences for the organization. From an operational standpoint, the disclosure of maintenance manuals and modification documents could negatively impact the company's operational security and its ability to maintain compliance with strict aviation standards. Furthermore, the exposure of this technical data could lead to the loss of trade secrets, potentially placing the organization at a competitive disadvantage.

There are also concerns regarding aviation safety, as the inclusion of specific details regarding aircraft maintenance processes may pose indirect risks to overall flight operations. In the broader context of cybercrime, this incident follows a pattern seen in many ransomware cases where data is published as part of a double-extortion strategy. In such scenarios, attackers not only encrypt a victim's data but also steal it, using the threat of public disclosure to exert maximum pressure on the organization.

While information regarding the specific capabilities and motives of the babuk2 group remains limited, their actions in this case align with common ransomware tactics. For organizations operating in the transportation and aviation sectors, such incidents highlight the importance of robust data protection measures. Defensive strategies typically involve implementing strict access controls, continuous monitoring of network traffic for unusual data transfers, and ensuring that sensitive technical documentation is encrypted both at rest and in transit to mitigate the impact of potential exfiltration.