babuk2 ransomware group lists mof.go.th - Ministry of Finance (Thailand) on its leak site

• Ransomware group: babuk2
• Country: Thailand
• Sector: Government & Defense
• Announcement date: March 20, 2025

A major data breach claim against the Ministry of Finance (Thailand)

The threat actor known as babuk2 has officially listed the Ministry of Finance (Thailand) on its leak site. According to the claims made by the group, a cyberattack has been carried out against the institution, resulting in the alleged exfiltration of approximately 5 TB of data. This announcement was made on March 20, 2025, and the group claims the attack occurred on the same date.

Details of the babuk2 claim

The threat actor asserts that they have successfully gained access to the institution's internal data. Following the listing, the group has issued an ultimatum: if the Ministry of Finance does not contact them, the threat actor intends to publish the stolen information within a one-week timeframe. While the group has made these significant claims, public information regarding the specific identity and background of the babuk2 group remains limited.

The threat actor utilizes a method often referred to as double extortion. In this tactic, attackers do not merely encrypt an organization's systems to disrupt operations; they also steal sensitive data to use as leverage. By threatening to release the information publicly, the attackers increase the pressure on the victim to meet ransom demands, creating a dual-layered crisis involving both operational downtime and massive data exposure.

Alleged data formats and types

The information claimed to be stolen by the group is said to be contained within several common file formats. These include:

• xlsx
• csv
• txt
• zip
• 7z
• pdf

The specific contents of the breach are described as including:

• Financial data
• Corporate documents

About the Ministry of Finance (Thailand)

The Ministry of Finance of Thailand is the government agency responsible for managing the country's fiscal policies, tax collection, budget planning, and overseeing public expenditures. As a central pillar of the nation's administration, the agency handles critical economic functions that are essential to the country's stability.

Risk assessment and organizational implications

The alleged leak poses a high level of severity due to the potential exposure of sensitive financial and administrative data belonging to a government institution. The public release of such data could have significant consequences, potentially impacting Thailand's national financial security and jeopardizing the privacy of citizens' personal information. Furthermore, the institution may face legal obligations under Thailand's local data protection regulations following such a breach.

Beyond the immediate impact, secondary risks are a significant concern. The leaked data could be utilized by malicious actors for identity theft or to facilitate highly targeted phishing attacks against individuals or other government entities. Such attacks often leverage the specific details found in leaked corporate or financial documents to gain trust and bypass security measures.

For organizations operating within the government and defense sectors, such incidents highlight the necessity of robust defensive postures. Common defensive steps include implementing strict access controls, maintaining comprehensive logging and monitoring to detect unauthorized data movement, and ensuring that data is encrypted both at rest and in transit. Additionally, maintaining regular, offline backups and conducting regular incident response drills are essential components of a resilient cybersecurity strategy to mitigate the impact of both encryption-based and exfiltration-based attacks.