babuk2 ransomware group lists nrru.ac.th - University on its leak site

• Ransomware group: babuk2
• Country: Thailand
• Sector: Education
• Announcement date: March 15, 2025

Babuk2 claims data breach at Nakhon Ratchasima Rajabhat University

The threat actor known as babuk2 has issued an announcement claiming to have successfully exfiltrated a significant amount of data from Nakhon Ratchasima Rajabhat University. According to the announcement published on a leak site on March 15, 2025, the group asserts they have obtained approximately 100 GB of data belonging to the institution. This incident highlights the ongoing risks faced by educational institutions by cybercriminal groups using extortion-based tactics.

Details of the alleged attack

The claims made by the babuk2 group suggest a large-scale compromise of the university's digital environment. The threat actor alleges that they accessed the personal information of approximately 990,000 individuals. Furthermore, the group claims that data belonging to 60,000 people has already been published. The announcement states that the total volume of extracted data from the institution's systems amounts to 100 GB. Publicly available information regarding the specific operations and background of the babuk2 group remains limited.

Ransomware groups often utilize leak sites to pressure victims into paying ransoms. In many modern cyberattacks, threat actors employ a strategy known as double extortion. In this scenario, the attackers do not just encrypt an organization's files to disrupt operations; they also steal sensitive data before the encryption process begins. The group then threatens to release this stolen information on public forums if the ransom is not met, thereby increasing the pressure on the victim through the threat of reputational damage and legal consequences.

Scope of the allegedly stolen data

The information allegedly stolen by the threat actor is extensive and covers various aspects of user identity and institutional activity. Based on the group's claims, the compromised data includes a wide range of sensitive identifiers and personal details. The specific categories of affected data mentioned in the announcement include:

• User IDs
• Hashed passwords
• Full names
• Email addresses
• Phone numbers
• Institutional information
• Major information
• Address information
• IP addresses
• Profile pictures

The presence of such diverse data types, including hashed passwords and contact information, increases the potential impact of the breach on the individuals involved.

About Nakhon Ratchasima Rajabhat University

Nakhon Ratchasima Rajabhat University is a public university located in Nakhon Ratchasima, Thailand. It is a higher education institution operating in the fields of education, research, and community service.

Risk assessment and organizational implications

The claims made by babuk2 pose significant secondary risks to the university community. For students and staff, the exposure of personal details such as names, emails, and phone numbers can lead to identity theft and highly targeted phishing attacks. When attackers possess specific information like a person's major or institutional details, they can craft much more convincing social engineering campaigns to deceive victims.

The nature of the data allegedly leaked suggests that there may have been vulnerabilities in the institution's data protection processes. For organizations in the education sector, such incidents often trigger complex legal and regulatory requirements. In this case, the university may face legal obligations under Thailand's Personal Data Protection Act (PDPA). Typically, when a breach of this magnitude is suspected, institutions may be required to share breach notifications with relevant authorities and inform the affected individuals to mitigate further harm.

To defend against such threats, organizations generally focus on strengthening their security posture through robust data encryption, multi-factor authentication, and continuous monitoring of network traffic to detect unauthorized data exfiltration. Implementing strict access controls and regular security audits are also standard defensive measures to protect sensitive institutional and personal data from unauthorized access.