Babuk2 ransomware group lists nuclep.gov.br. Nuclep Brazil on its leak site

• Ransomware group: Babuk2
• Country: Brazil
• Sector: Government & Defense
• Announcement date: March 14, 2025

Babuk2 claims to have exfiltrated 1.7TB of data from Nuclep Brazil

The Babuk2 ransomware group has listed Nuclep Brazil on its leak site, claiming to have successfully exfiltrated 1.7TB of data from the organization. The announcement, which was made on March 14, 2025, suggests a significant breach of sensitive information belonging to the Brazilian state-owned entity.

Details of the alleged attack

According to the claims made by the Babuk2 group, the unauthorized access to Nuclep Brazil's systems occurred on March 13, 2025. The group's announcement alleges that the breach has compromised data specifically related to the organization's critical operations within the defense and nuclear energy sectors. While the group has published the organization's name and the volume of data, no specific ransom demand has been disclosed in the public announcement.

Ransomware groups often utilize leak sites to apply pressure on victims through a tactic known as double extortion. In such scenarios, attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to threaten its public release. This method is designed to coerce the victim into paying a ransom to prevent the disclosure of proprietary or sensitive data that could cause significant reputational or operational damage.

The allegedly compromised data

The Babuk2 group claims that the stolen information includes a wide range of sensitive files and personal details. The data allegedly exfiltrated includes:

• Defense industry production files
• Nuclear mining images
• AutoCAD schematics
• Coordinate information
• Employee personal data, including names, emails, and passwords

The inclusion of technical schematics and production files alongside employee credentials highlights the multifaceted nature of the alleged theft, which spans both corporate intellectual property and individual privacy.

About Nuclep Brazil

Nuclep (Nuclebrás Equipamentos Pesados S.A.) is a state-owned company in Brazil. The organization specializes in the manufacturing of heavy equipment tailored for the nuclear and defense industries. Its technical expertise is focused on the production of critical components used in nuclear power plants and for submarines.

Strategic implications and organizational risks

This incident may pose strategic risks due to the organization's position in the defense and nuclear energy sectors. The public disclosure of the leaked data could affect the organization's operational security and national security interests. Furthermore, the exposure of employee information, such as names and passwords, may facilitate targeted phishing attacks against the organization's personnel, as attackers can use these details to craft more convincing social engineering campaigns.

From a regulatory perspective, the organization may face legal processes under Brazil's data protection legislation (LGPD). When organizations deal with highly sensitive sectors like defense and nuclear energy, the impact of a breach extends beyond immediate operational disruption to potential long-term consequences for national security and regulatory compliance. While information about the Babuk2 group remains limited in the public domain, such incidents underscore the necessity for organizations to maintain robust defensive postures, including regular security audits, strict access controls, and comprehensive employee training to mitigate the risks of data exfiltration and targeted social engineering.