Babuk2 ransomware group lists knesset.gov.il on its leak site

• Ransomware group: Babuk2
• Country: Israel
• Sector: Government & Defense
• Announcement date: March 15, 2025

Babuk2 group claims theft of Knesset data

The Babuk2 ransomware group has published a claim on its leak site regarding a data breach targeting the Israeli Knesset. According to the announcement made on March 15, 2025, the threat actor claims to have exfiltrated approximately 910 GB of data belonging to the organization. This massive volume of information reportedly consists of over 200,000 documents. While the group has provided public download links for a portion of the data, information regarding this specific threat actor remains limited.

The claim suggests that the initial attack may have occurred as early as October 25, 2024. In modern ransomware operations, groups often utilize a "double extortion" tactic. This method involves not only encrypting an organization's systems to disrupt operations but also stealing sensitive data to use as leverage. By threatening to leak the stolen information on public forums or dedicated leak sites, attackers aim to pressure the victim into paying a ransom to prevent the disclosure of confidential files.

Details of the claimed data exfiltration

The data allegedly stolen by the Babuk2 group is said to include a wide variety of sensitive materials. The leaked content is reported to encompass internal communications, official reports, and various legislative files. Furthermore, the breach is claimed to involve documents related to several key government entities, specifically the Ministry of Defense, the Ministry of Health, and the Ministry of Education.

The files mentioned in the claim include several common digital formats, such as:

• PDF
• Video files
• Images
• DOC and DOCX
• XLSX and CSV

The breadth of these file types suggests a comprehensive collection of administrative, communicative, and legislative information. The presence of spreadsheets and document files often indicates that the attackers targeted organizational databases and administrative workflows.

The organization targeted

The target of this alleged attack is the Knesset, which serves as the unicameral national legislature of Israel. As a central pillar of the Israeli government, the Knesset is responsible for conducting the country's legislative activities and overseeing the government's actions. Because of its role in the democratic process and its oversight functions, the institution handles significant amounts of sensitive state information.

Potential implications and security considerations

Should the leaked data be verified, the incident could have significant negative implications for the operational security of the Israeli government and the communications between various state entities. Such leaks targeting public institutions can create serious concerns regarding the disclosure of state secrets and potential national security risks. The content of the leaked data might be utilized by foreign intelligence services or other threat actors to conduct sophisticated cyber operations, such as spear-phishing attacks.

When such a breach occurs, organizations typically face several secondary risks. These include the possibility of supply chain attacks, where the stolen information is used to compromise connected partners, and significant institutional reputational damage. In response to such events, it is common for institutions to initiate investigations within the framework of national data protection regulations and relevant legislation to determine the scope of the compromise.

For organizations within the government and defense sector, maintaining robust defensive postures is critical. This involves implementing strict access controls, continuous monitoring of network traffic for unusual exfiltration patterns, and ensuring that all legislative and administrative communications are encrypted. Protecting the integrity of state communications is vital to preventing the exploitation of sensitive data by external adversaries.