Babuk2 ransomware group lists towellengineering.net on its leak site

• Ransomware group: Babuk2
• Country: Oman
• Sector: Manufacturing
• Announcement date: March 29, 2025

Babuk2 claims data breach against Towell Engineering

The threat actor known as Babuk2 has announced that they have published a significant amount of data allegedly belonging to Towell Engineering. According to the announcement made on their leak site on March 29, 2025, the group claims to have obtained approximately 120 GB of information from the organization. While the group has published this claim, the specific details regarding the attack itself remain limited.

Ransomware groups often utilize leak sites to exert pressure on their victims through a tactic known as double extortion. In these scenarios, attackers do not just encrypt an organization's files to disrupt operations; they also steal sensitive information to threaten its public release. By publishing data on a dedicated site, the threat actors aim to damage the victim's reputation and force compliance with ransom demands. In this specific instance, the group has already moved to the stage of publishing sample documents to validate their claims.

Details of the claimed data leak

The announcement by Babuk2 suggests that the stolen information is quite extensive, totaling 120 GB. The group has provided samples of documents to support their claim of having access to the organization's internal files. These samples indicate that the breach involves sensitive operational and financial documentation. The specific types of data mentioned in the leak include:

• Internal audit reports
• Sub-contractor payment information
• Project contract details

The presence of such documents on a leak site indicates a potential compromise of the organization's internal administrative and financial workflows. It is important to note that no information was provided regarding the specific file count or the ransom demand associated with this incident.

About Towell Engineering

Towell Engineering is an Oman-based company that provides a wide range of industrial projects, construction, and engineering services. The organization is involved in delivering various engineering solutions across several critical sectors, including energy, water, and infrastructure. Given its role in these essential industries, the company maintains complex operational processes involving various stakeholders and subcontractors.

Impact and security considerations

This incident may pose a significant risk of exposing the company's trade secrets and operational data. The public disclosure of internal documents, such as audit reports and contract details, could negatively impact the company's supply chain relationships and its overall competitive advantage. Furthermore, such leaks may create opportunities for targeted phishing attacks against employees and business partners, as attackers can use the stolen information to craft highly convincing fraudulent communications.

In the manufacturing and engineering sectors, maintaining the confidentiality of project details and subcontractor information is vital for operational integrity. When an organization faces a potential data leak, it may need to review its data security processes and notify relevant parties to mitigate further damage. General defensive steps for organizations facing such threats typically include implementing robust access controls, enhancing monitoring of sensitive data movements, and conducting regular security awareness training to prevent social engineering and phishing attempts.

Publicly available information regarding the Babuk2 group remains limited, making it difficult to determine the full scope of their operations or their specific methodologies. As with many ransomware incidents, the impact of a breach often extends beyond the immediate loss of data to include long-term reputational and relationship-based consequences.