babuk2 ransomware group lists Polizia italia mail access on its leak site

• Ransomware group: babuk2
• Country: Italy
• Sector: Government & Defense
• Announcement date: April 3, 2025

Threat actor group claims access to Italian police email account

The threat actor group known as babuk2 has published an announcement on a leak site claiming to have successfully compromised an email account associated with Polizia di Stato. The claim, which was announced on April 3, 2025, suggests that the group has gained unauthorized access to the internal communications of the Italian national civil police force.

Ransomware groups often utilize leak sites to host announcements regarding their activities. These platforms serve as a method of pressure, where threat actors claim to have stolen sensitive data to coerce organizations into paying a ransom. This tactic is frequently associated with double extortion, where data is not only encrypted but also threatened with public exposure to increase the likelihood of payment.

Details of the claimed breach and the group's offer

According to the announcement made by babuk2, the group is not merely claiming to have stolen data, but is actively offering the access to the compromised email account for sale. The threat actor specifically stated that the access obtained could be utilized to bypass Endpoint Detection and Response (EDR) systems. By leveraging legitimate credentials or an active session within a trusted email environment, attackers can often move laterally through a network while appearing as authorized users, thereby evading many standard security monitoring tools.

The group's claim focuses on the utility of the access for further exploitation. In many modern cyberattacks, gaining access to a high-value email account serves as a gateway to the wider corporate or government network. Once inside, attackers can intercept sensitive communications, harvest further credentials, or deploy malware under the guise of legitimate internal traffic.

Affected data and evidence provided

The threat actor provided a screenshot as evidence to support their claim. This visual evidence displays the inbox interface of an email account under the poliziadistato.it domain. The interface reveals various pieces of information, including official correspondences, OTP (One-Time Password) notifications, and various internal institutional announcements. Based on the information provided, the following data types are reportedly involved:

• Email content
• Internal communications

The organization involved

Polizia di Stato is the national civil police force of Italy. As a government agency, it is responsible for maintaining public order, combating crime, and protecting internal security within the country.

Analysis and potential implications

This claim highlights the potential risks associated with unauthorized access to government institutions. Access to such an email account may lead to the disclosure of sensitive internal information and could facilitate broader network infiltration. Given that the institution operates in Italy, data protection obligations under GDPR and related legal processes may be triggered by such an incident.

The threat actor's attempt to sell this access suggests that the data could be leveraged for secondary attacks or targeted phishing campaigns. Such campaigns often use the context of real, internal communications to trick employees into revealing even more sensitive information or downloading malicious payloads.

For organizations within the government and defense sectors, this incident underscores the necessity of robust identity and access management. Implementing multi-factor authentication (MFA) is a standard defensive step to prevent unauthorized access via stolen credentials. Furthermore, continuous monitoring of anomalous login patterns and the use of advanced security telemetry can help detect when an account is being used in an unusual manner, even if the actor attempts to bypass EDR systems.

Information regarding the babuk2 group remains limited in the public domain, making it difficult to ascertain their full capabilities or long-term objectives. Organizations are encouraged to maintain heightened vigilance and follow established incident response protocols when faced with claims of compromise from such entities.