Babuk2 ransomware group lists The Ministry of National Defense - mod.gov.vn (NavyVietnam) on its leak site

• Ransomware group: Babuk2
• Country: Vietnam
• Sector: Government & Defense
• Announcement date: March 14, 2025

Babuk2 claims data breach at Vietnam Ministry of National Defense

The Babuk2 ransomware group has published a leak announcement claiming to have obtained data belonging to the Vietnam Ministry of National Defense (mod.gov.vn). This announcement, made on March 14, 2025, suggests a significant breach targeting a key government institution in Vietnam.

According to the claims made by the group, the incident involves a substantial amount of information. The group alleges that they have obtained 2 GB of data, which corresponds to approximately 500 MB when compressed. This data set is said to contain roughly 6,663,379 records. In their announcement, the group provided an external link intended for downloading the alleged data.

Details of the alleged data leak

The information disclosed by the Babuk2 group includes a wide variety of sensitive personal identifiers. Based on the announcement, the leaked data is said to include the following types of information:

• Identity number
• Full name
• Date of birth
• Gender
• Nationality
• Place of origin
• Place of residence
• Document expiry date

The exposure of such specific personal details, including identity numbers and residential information, represents a significant privacy concern for the individuals whose data is allegedly contained within the leak.

The organization profile

The Ministry of National Defense of Vietnam is the government agency responsible for the country's military forces and national defense policy. It manages and exercises operational control over the Vietnam People's Army.

Strategic implications and security considerations

This leak claim may present a high level of severity due to the exposure of sensitive data belonging to a government institution. The nature of the alleged data could increase the risk of identity theft and targeted phishing attacks against the affected individuals. Given the institution's association with national defense, the breach may have strategic implications and could potentially impact supply chain security.

In the context of modern cyber threats, ransomware groups often employ double extortion tactics. This method involves not only encrypting an organization's data to disrupt operations but also stealing sensitive information to use as leverage. By threatening to publish stolen data on a leak site, attackers aim to pressure the victim into paying a ransom to prevent public disclosure.

Information about the Babuk2 group remains limited. If the incident is verified, it may trigger legal processes under Vietnam's data protection regulations. For organizations operating within the government and defense sectors, maintaining robust security postures is critical. Common defensive steps include implementing strict access controls, maintaining comprehensive logging and monitoring, and conducting regular security audits to identify vulnerabilities before they can be exploited by threat actors.