babuk2 ransomware group lists carc.gov.jo on its leak site

• Ransomware group: babuk2
• Country: Jordan
• Sector: Government & Defense
• Announcement date: January 27, 2025

The threat actor known as babuk2 has listed the domain carc.gov.jo on its dedicated leak site, claiming to have exfiltrated and published data belonging to the Civil Aviation Regulatory Commission (CARC) of Jordan. The announcement, made on January 27, 2025, alleges that the group has successfully compromised the institution and has made a significant volume of sensitive information accessible to the public.

The alleged data breach incident

According to the claims made by the babuk2 group, the breach involved the unauthorized access and subsequent exfiltration of various documents and files. The threat actor alleges that the stolen data totals over 1 GB in size. The group claims that the leaked material is not merely administrative but includes highly sensitive information related to the institution's internal operations and strategic planning.

Specifically, the group asserts that the leaked data contains secret documents pertaining to the organization's cybersecurity plans and airspace management. This type of claim is common in modern ransomware operations, where attackers often employ a "double extortion" tactic. In such scenarios, the threat actors do not only encrypt the victim's systems but also steal sensitive data to use as leverage, threatening to release it on a public leak site if the ransom demand is not met.

While the group has published this information on their leak site, it is important to note that these are currently unverified claims made by the threat actor. The group has not provided specific details regarding the method of entry or the exact nature of the files beyond the general categories mentioned in their announcement.

The data allegedly involved in the leak

The babuk2 group claims that the exfiltrated data consists of a variety of sensitive files. Based on the group's announcement, the leaked content is said to include over 1 GB of information, which allegedly consists of the following types of data:

• Secret PDF files
• Operational plans
• Cybersecurity plans

The inclusion of cybersecurity plans in a leak is particularly significant for any organization. Such documents often outline the defensive measures, network architectures, and incident response protocols that an entity relies upon to protect its assets. When these plans are exposed, they can potentially serve as a roadmap for future malicious activities.

About the Civil Aviation Regulatory Commission

The Civil Aviation Regulatory Commission (CARC) of Jordan is the official government body responsible for regulating, overseeing, and ensuring the safety and security of civil aviation activities within the country. As a regulatory authority, the organization plays a critical role in maintaining the integrity of the nation's aviation sector and ensuring compliance with safety standards.

Potential impact and organizational security

This alleged leak may pose a significant risk of exposing sensitive information regarding Jordan's critical infrastructure and aviation regulatory processes. The publication of an institution's cybersecurity plans could potentially provide a roadmap for future attacks and weaken the overall operational security of the organization. Furthermore, the public disclosure of such sensitive data may negatively impact the institution's ability to maintain compliance with international aviation standards.

Information regarding the babuk2 group remains limited; however, it is possible that ransomware actors may utilize such data for secondary attacks or for further extortion purposes. In the broader context of cybersecurity, organizations in the government and defense sectors often face sophisticated threats due to the high value of the data they manage.

To mitigate the risks associated with such breaches, organizations in critical sectors typically focus on several defensive strategies. These include implementing robust identity and access management to ensure only authorized personnel can access sensitive files, maintaining rigorous patch management to close vulnerabilities, and employing continuous monitoring to detect unusual data movement. Additionally, regular security audits and the implementation of zero-trust architectures are common practices used to strengthen the defensive posture against evolving ransomware threats.