Babuk2 claims data breach at rac.gov.my

• Ransomware group: Babuk2
• Country: Malaysia
• Sector: Government & Defense
• Announcement date: March 19, 2025

Babuk2 claims data breach at rac.gov.my

The Babuk2 ransomware group has listed the Malaysian organization rac.gov.my on its leak site, claiming to have successfully exfiltrated a significant volume of data. According to the announcement made on March 19, 2025, the threat actor group alleges that the breach occurred on the same day it was posted. The group has provided instructions for the organization to establish contact through encrypted messaging platforms to resolve the matter.

Details of the alleged attack

The claim made by the Babuk2 group suggests a substantial data theft. The group alleges that they have acquired approximately 150 GB of data belonging to the organization. While the group has posted a screenshot indicating that a portion of this data has already been uploaded to an external file-sharing platform, no specific information was provided regarding a ransom demand or the exact file count involved in the incident.

Information regarding the Babuk2 group remains limited in the public domain, making it difficult to ascertain their full operational profile. However, the group's presence on a leak site is a common tactic used in modern cyberattacks. Ransomware leak sites serve as a platform for threat actors to pressure victims by threatening to release sensitive information if their demands are not met. This specific incident highlights the ongoing threat posed by such groups to various sectors.

Affected data types

Based on the claims made by the threat actor, the exfiltrated information is said to consist of files belonging to the organization's employees. Specifically, the listing identifies the following affected data:

• Employee data

About the Railway Assets Corporation

The target of this alleged attack is the Railway Assets Corporation (RAC), which operates under the Ministry of Transport in Malaysia. The RAC is a federal statutory body within the country. As an official entity, the organization is responsible for the regulation and oversight of amateur radio activities. Its mandate includes the licensing and management of amateur radio operators within the fields of communications and multimedia.

Analysis and potential impact

The claims made by Babuk2 suggest a high-risk situation for the organization. The group appears to be employing double-extortion tactics, a method where attackers not only encrypt an organization's systems but also steal sensitive data to use as leverage. This approach increases the likelihood that the stolen data will be published or sold on the dark web, even if the organization manages to restore its systems from backups.

The potential public release of the alleged data poses significant risks to the operational security of the organization and the privacy of its employees. Specifically, the exposure of employee-related files could facilitate targeted phishing or social engineering attacks against the staff members. Such attacks often leverage stolen personal information to gain further access to corporate networks or to commit identity theft.

Furthermore, because the organization operates within the critical infrastructure sector, the severity of the incident is heightened. Attacks on critical infrastructure can have broader implications for national security and public services. Under Malaysian data protection regulations, the organization may also face specific notification obligations regarding the potential compromise of personal data. To mitigate such risks, organizations in this sector typically focus on robust data encryption, strict access controls, and continuous monitoring to detect unauthorized data exfiltration attempts.