Babuk2 claims to have obtained administrative access to maxprofit.mcode.me

• Ransomware group: Babuk2
• Announcement date: January 27, 2025

The Babuk2 ransomware group has issued a claim on a leak site regarding the platform maxprofit.mcode.me. In a recent announcement, the threat actor group asserted that they have successfully obtained administrative access credentials for the entity, which they are now attempting to sell on the dark web.

The details of the claim

According to the announcement posted on January 27, 2025, the Babuk2 threat actor claims to have gained administrative access to the maxprofit.mcode.me entity. This claim was made via a post on a leak site, a common tactic used by ransomware groups to pressure victims or to monetize stolen access. The group is currently demanding a payment of 10,000 USD in exchange for the access credentials.

In a move often used to create a sense of urgency among potential buyers, the group further stated that the price may be reduced to 8,000 USD for the first buyer. This pricing strategy is a common feature in cybercriminal marketplaces, where attackers attempt to facilitate a quick sale by offering temporary discounts to the initial interested party.

Data and access involved

The post specifically offers for sale what is claimed to be administrative access credentials for the entity's panel. While various download links are visible in the provided screenshots, there is no detailed information regarding the full scope or nature of the compromised data. The listing does not specify the volume of data or the exact number of files involved in the alleged breach.

• Administrative access credentials

Because the group is offering access to a management panel, the potential impact of such a breach is significant. Ransomware groups often use administrative credentials to move laterally through a network, escalate privileges, and eventually deploy encryption across multiple systems.

Analysis and potential risks

This situation may pose a risk of unauthorized access to the entity's systems. The sale of administrative credentials could imply that control over the entire infrastructure may be compromised by threat actors. Such a breach may lead to the total exposure of the entity's data or the encryption of systems via ransomware. Furthermore, secondary risks such as identity theft for the entity's customers and employees may be observed.

In the broader context of cyber threats, this type of attack highlights the danger of credential-based intrusions. When administrative accounts are compromised, attackers gain a high level of authority that can be used to disable security software, delete backups, or exfiltrate sensitive information. This often leads to a double extortion scenario, where the attackers not only encrypt the data but also threaten to leak it to cause reputational and operational damage.

Organizations facing such risks typically focus on several defensive pillars. Implementing multi-factor authentication (MFA) across all administrative accounts is a primary defense against credential theft. Additionally, maintaining strict principle of least privilege (PoLP) ensures that even if an account is compromised, the potential movement of the attacker is limited. Organizations also rely on robust logging and monitoring to detect unauthorized access to administrative panels in real-time. Finally, ensuring that backups are stored in an immutable or offline format is a critical step in mitigating the impact of a ransomware deployment that follows a breach.

Publicly available information regarding the Babuk2 group remains limited, making it difficult to determine the full extent of their operational methods or historical activity. However, the claim regarding maxprofit.mcode.me underscores the ongoing threat posed by groups that specialize in selling high-level access to corporate infrastructures.