Babuk2 claims data leak involving drdo.gov.in

• Ransomware group: babuk2
• Country: India
• Sector: Government & Defense
• Announcement date: April 2, 2025

Babuk2 claims massive data breach at drdo.gov.in

The threat actor known as babuk2 has announced a significant data leak involving the website of the Defence Research and Development Organisation (DRDO), located at drdo.gov.in. According to the announcement posted on a leak site on April 2, 2025, the group claims to have exfiltrated a massive volume of data, totaling 30 TB, allegedly belonging to the Indian government agency.

In this alleged event, the threat actor claims to have accessed and stolen various defense technologies and military documents. The group asserts that the stolen data spans a significant timeframe, covering the years from 2011 to 2025. The announcement includes threatening language directed specifically at defense companies and military units, with the group stating that they will release all the information if their demands are not met. While the group has made these claims, no specific ransom demand was mentioned in the announcement.

Alleged contents of the leaked data

The data claimed to be stolen by babuk2 is described as being highly sensitive in nature. The group alleges that the exfiltrated information includes a wide range of strategic and administrative assets. Specifically, the leaked data is claimed to include:

• Defense technology documents
• Missile system data
• Personnel information
• Government documents

The scope of the alleged theft suggests a deep penetration into the organization's digital repositories, covering over a decade of documentation and technical data.

About the Defence Research and Development Organisation

The Defence Research and Development Organisation (DRDO) is the official government agency operating under the Ministry of Defence of India. The organization is responsible for the development of essential technology for the Indian military. Its research and development activities are conducted across several critical areas, including military systems, aeronautics, armaments, and electronic warfare.

Implications and security assessment

This alleged leak poses a potentially high risk to India's national security and its defense infrastructure. The nature of the data involved—ranging from missile systems to military personnel information—could lead to the exposure of sensitive military projects and could compromise the security of the broader defense supply chain. Given the strategic importance of the DRDO as a government institution, it is expected that investigation processes will be initiated under relevant national security protocols following such an incident.

The threat actor babuk2 has limited public information available regarding its specific history and technical methods. However, targeting strategic entities such as defense organizations can facilitate secondary attacks or highly targeted phishing campaigns against the individuals and companies involved in the defense sector.

In the context of modern cyber threats, such incidents often follow the pattern of double extortion, where attackers not only encrypt systems but also steal sensitive data to use as leverage for ransom. Organizations in the government and defense sectors typically focus on robust defensive measures to mitigate these risks, including strict access controls, continuous monitoring of network traffic, and comprehensive encryption of sensitive data at rest and in transit. Furthermore, maintaining rigorous supply chain security and conducting regular security audits are essential steps for protecting national defense interests against sophisticated threat actors.