Babuk2 ransomware group lists parliament.iq on its leak site

• Ransomware group: Babuk2
• Country: Iraq
• Sector: Government & Defense
• Announcement date: March 14, 2025

Babuk2 claims data breach at parliament.iq

The threat actor known as Babuk2 has announced a cyberattack targeting parliament.iq. According to the group's announcement on a leak site, they claim to have exfiltrated approximately 900 GB of data and documents from the institution's systems. This announcement, made on March 14, 2025, marks a significant escalation in the group's activity against government entities.

The group has already begun publishing portions of the stolen information. They have released a 19 GB compressed dataset to the public. This publication is a common tactic used by modern ransomware groups to pressure victims into meeting their demands through public exposure of sensitive information.

Details of the claimed data exfiltration

The content of the leak is said to be highly sensitive, involving various types of internal documentation. The attackers claim to possess a wide array of information that could compromise the integrity of the institution. The specific types of data mentioned in the claim include:

• ID photos
• Official documents
• Excel files
• Server access credentials
• Authentication logs

The presence of server access credentials and authentication logs is particularly concerning, as these assets can provide attackers with continued or elevated access to a network, potentially allowing for further lateral movement or persistent presence within the infrastructure.

The Parliament of Iraq

The target of this alleged attack is the Parliament of Iraq. This institution serves as the legislative body of the Republic of Iraq. It is the primary government institution responsible for managing the country's constitutional processes and legislative activities.

Risk assessment and organizational implications

This incident may pose a significant risk due to the exposure of sensitive government data. The leaked credentials and server access logs could facilitate secondary attacks or targeted phishing campaigns against the institution. Furthermore, the publication of official documents may lead to a compromise in institutional security and a loss of public trust.

Information regarding the Babuk2 group remains limited. However, given that ransomware actors typically employ double-extortion tactics, this situation may create pressure on the institution's operational continuity. Double extortion is a strategy where attackers not only encrypt an organization's data but also steal it, threatening to leak the sensitive information if a ransom is not paid. This method increases the pressure on victims, as paying the ransom does not guarantee that the stolen data will be deleted.

For organizations operating within the government and defense sector, such incidents highlight the critical need for robust cybersecurity frameworks. To mitigate the risks associated with such attacks, organizations often implement multi-factor authentication to protect against the use of stolen credentials. Additionally, monitoring authentication logs for unusual patterns can help detect unauthorized access attempts early. Regular security audits and the implementation of strict access controls are also essential defensive steps to protect sensitive legislative and constitutional data from unauthorized exfiltration.