babuk2 ransomware group lists dealplexus.com on its leak site

• Ransomware group: babuk2
• Country: India
• Sector: Financial Services
• Announcement date: January 27, 2025

The threat actor known as babuk2 has announced a data leak allegedly belonging to the dealplexus.com platform. According to an announcement made on January 27, 2025, the group claims to have successfully compromised the organization's systems and made the resulting data available to the public.

The alleged attack and claim

The threat actor known as babuk2 published an announcement on January 27, 2025, claiming to have compromised data belonging to dealplexus.com. The group alleges that it gained access to the institution's database and has made the data publicly available. In the post, a download link for the alleged data has been provided, along with claims that sample data is included within the leak.

While the group has made these claims, information regarding the identity and specific details of this threat actor remains limited. Ransomware groups often utilize leak sites to pressure victims through a method known as double extortion. In these scenarios, attackers not only encrypt an organization's systems but also steal sensitive information, threatening to release it publicly if a ransom is not paid. This tactic aims to maximize leverage by threatening the victim's reputation and legal standing.

The alleged compromised data

The information allegedly exfiltrated by the threat actor is significant in scope and variety. The group claims that the stolen data includes a wide range of sensitive technical and personal information. The specific items identified in the claim include:

• User IDs
• Email addresses
• Phone numbers (approximately 4 million lines)
• Source code
• Secret hashes
• Secret keys

The exposure of such diverse data types presents multiple layers of risk. When sensitive credentials like hashes and keys are leaked, the security of the entire digital environment is often called into question. Furthermore, the inclusion of source code suggests a deep level of access into the organization's proprietary software and internal logic.

About DealPlexus

DealPlexus is an India-based investment banking and corporate finance advisory firm. The company provides services in mergers and acquisitions, private equity transactions, and debt restructuring.

Potential impact and organizational implications

The alleged leak may pose significant risks, such as identity theft and targeted phishing attacks, for the institution's users. The exposure of source code and secret keys could potentially lead to broader attacks against the institution's digital infrastructure. Given that the institution is based in India, legal processes under relevant local data protection regulations may be triggered as a result of this incident.

The disclosure of this data could negatively impact the institution's commercial reputation and compromise the security of customer financial information. Additionally, the fact that the threat actor is sharing the data for free may lead to the rapid dissemination of the information by malicious third parties, increasing the overall risk profile of the breach.

In the financial services sector, organizations typically focus on robust defensive measures to mitigate such risks. These include implementing multi-factor authentication, maintaining strict access controls, and conducting regular security audits. Protecting the integrity of source code and secrets is a critical component of modern cybersecurity, as these elements are foundational to the security of an organization's digital assets. Organizations in this sector must also be prepared to comply with local regulatory frameworks regarding data protection and incident reporting to manage the legal and reputational consequences of a potential breach.