Babuk2 claims data breach at aman-iraq.com

• Ransomware group: Babuk2
• Country: Iraq
• Sector: Government & Defense
• Announcement date: March 26, 2025

Babuk2 claims a massive data exfiltration against aman-iraq.com

The Babuk2 ransomware group has announced a cyberattack targeting aman-iraq.com, a security and defense services provider based in Iraq. According to the announcement posted on a leak site on March 26, 2025, the threat actor claims to have successfully exfiltrated approximately 200 GB of documents and data from the organization's systems. The group has stated that the attack occurred on the same day the announcement was made.

In a typical double extortion tactic often employed by ransomware groups, the attackers do not merely encrypt files but also steal sensitive information to use as leverage. By threatening to publish the stolen data on public leak sites, these groups aim to pressure the victim organization into paying a ransom to prevent the exposure of confidential information. In this specific instance, the group has demanded that the institution contact them in order to prevent the publication of the exfiltrated data.

Details of the alleged data theft

The information allegedly stolen by the Babuk2 group is highly sensitive, encompassing a wide range of personal and administrative details. The group claims to have accessed a variety of identity-related documents and personal identifiers that could be used for malicious purposes. According to the claims, the compromised data includes:

• User personal data
• Identity documents
• Driver's license information
• Vehicle information
• System administrator credentials

Beyond the general categories of user information, the group specifically alleges that the stolen data contains full names, dates of birth, phone numbers, email addresses, photos, identity cards, and driver's licenses. Furthermore, the threat actor claims to have compromised critical administrative information, specifically stating that usernames, emails, and passwords belonging to system administrators have been taken during the breach.

About aman-iraq.com

Aman Iraq is a security and defense services provider based in Iraq. The organization provides support for various defense and security operations in the region, making it a significant entity within the local security and defense sector.

Potential risks and organizational impact

The alleged breach of aman-iraq.com carries significant implications for both the organization and the individuals whose data was targeted. The sensitivity of the leaked information suggests a high risk of identity theft and fraud for the individuals served by the institution. When identity documents, driver's licenses, and vehicle information are exposed, it provides a toolkit for criminals to conduct sophisticated fraudulent activities.

Furthermore, the compromise of system administrator credentials represents a severe security risk. Such credentials could potentially lead to wider unauthorized access to the institution's infrastructure, allowing attackers to move laterally through networks or maintain long-term persistence. Given the sensitive nature of the services provided by Aman Iraq, individuals whose data has been leaked may be particularly vulnerable to highly targeted phishing attacks.

For organizations operating within the security and defense sectors, such incidents can have profound negative impacts on operational reliability. To mitigate such risks, organizations typically implement defensive measures such as multi-factor authentication (MFA) to protect administrative accounts, robust encryption for data at rest and in transit, and continuous monitoring of network traffic to detect unauthorized exfiltration. While public information regarding the specific capabilities and methods of the Babuk2 group remains limited, the nature of this claim highlights the ongoing threat posed by ransomware groups targeting critical service providers.