Babuk2 ransomware group claims data breach at airexplore.aero

• Ransomware group: Babuk2
• Country: Slovakia
• Sector: Transportation
• Announcement date: March 24, 2025

Babuk2 claims to have stolen data from airexplore.aero

The Babuk2 ransomware group has published an announcement on its leak site claiming responsibility for a cyberattack against the Slovakian aviation company airexplore.aero. According to the group's claims, they have successfully gained unauthorized access to the organization's internal systems. This announcement, which appeared on March 24, 2025, serves as a notification of a potential data breach involving a significant volume of information.

The group asserts that they have obtained approximately 500 GB of data. While the specific nature of the files is described as documents, the group has not provided further details regarding the exact file count or the specific types of files contained within the stolen dataset. Furthermore, the group has not publicly disclosed a specific ransom demand at this time. The announcement functions as a threat, stating that if the organization does not comply with the group's demands, the stolen information may be released to the public.

Details of the alleged data theft

The incident involves a substantial amount of information, which the threat actor claims to have exfiltrated from the target's network. Based on the information provided by the ransomware group, the breach involves the following:

• Corporate documents

The group's claims suggest that the stolen material consists of internal company documentation. In many modern ransomware attacks, groups utilize a tactic known as double extortion. In this scenario, attackers do not just encrypt an organization's data to disrupt operations; they also steal sensitive information to use as leverage. By threatening to leak the data on a public forum, the attackers aim to pressure the victim into paying a ransom to prevent the reputational and regulatory damage that follows a public disclosure of sensitive files.

About airexplore.aero

AirExplore is a charter airline based in Slovakia. The company provides passenger and cargo transport services and operates ACMI (aircraft, crew, maintenance, and insurance) leasing operations worldwide. Given its role in international transport and leasing, the organization maintains complex operational networks to support its global services.

Potential impact and security considerations

This incident may negatively impact the organization's operational continuity and commercial reputation. Depending on the nature of the leaked data, secondary risks such as identity theft or targeted phishing attacks against the organization's customers and partners may be observed. As an entity operating in the aviation sector, the disclosure of data may create challenges regarding regulatory compliance.

The Babuk2 group remains a subject of limited information, and their specific methods and technical capabilities remain uncertain. For organizations operating in critical sectors like aviation, such incidents highlight the necessity of robust data security measures. To mitigate the risks associated with potential data breaches, organizations typically focus on several proactive defensive steps:

• Implementing strict access controls to limit the movement of attackers within a network.
• Maintaining comprehensive backups that are isolated from the primary network to ensure operational continuity.
• Continuous monitoring of network traffic to detect unauthorized exfiltration of large data volumes.
• Regularly reviewing and updating security protocols to address evolving threats.

The potential for secondary attacks, such as highly targeted phishing campaigns using stolen corporate information, underscores the importance of maintaining a strong security posture and preparing for the aftermath of a data leak.