Babuk2 ransomware group lists uniproof.com.br on its leak site

• Ransomware group: Babuk2
• Country: Brazil
• Sector: Professional Services
• Announcement date: April 1, 2025

Babuk2 claims massive data exfiltration from uniproof.com.br

The Babuk2 ransomware group has announced on its leak site that it has successfully targeted the Brazilian professional services firm uniproof.com.br. According to the group's announcement made on April 1, 2025, the threat actors claim to have exfiltrated approximately 550 GB of data from the organization's systems. This claim follows an alleged attack that occurred on the same day the announcement was posted.

In the landscape of modern cybercrime, ransomware groups often employ a strategy known as double extortion. This method involves not only encrypting an organization's data to disrupt operations but also stealing sensitive information before the encryption process begins. By threatening to leak this stolen data on public forums or specialized leak sites, attackers increase their leverage to demand ransom payments. While the specific ransom demand for this incident has not been disclosed by the group, the scale of the alleged theft suggests a significant breach of confidentiality.

Details of the alleged breach and stolen information

The Babuk2 group alleges that it has breached the systems of uniproof.com.br and obtained a vast amount of information. Beyond the sheer volume of the data, the group claims to have compromised critical system access credentials. This includes sensitive information such as usernames and passwords, which could potentially grant the attackers continued or unauthorized access to the corporate environment.

The information allegedly stolen during this operation is diverse and includes highly sensitive documentation. The group claims that the exfiltrated data consists of the following items:

• Notary documents
• Digital records
• Address details
• Government-issued proofs
• Payment notes
• System access credentials

The presence of such varied data types indicates a deep penetration into the organization's digital infrastructure, targeting both administrative credentials and client-facing documentation.

About Uniproof

Uniproof is a Brazil-based company that provides digital certification, electronic signature solutions, and identity verification services. The company operates in the field of secure digital transactions and document management, making it a repository for sensitive personal and legal information.

Potential risks and industry implications

This alleged breach poses significant risks due to the nature of the data stored on the institution's digital platform. The exposure of sensitive notary and government-issued data could have long-term consequences for the individuals involved. Furthermore, the exposure of alleged system access credentials may weaken the institution's network security, potentially facilitating secondary attacks or further unauthorized access by other threat actors.

From a regulatory perspective, such an incident in Brazil could lead to legal sanctions and administrative fines under the LGPD (Lei Geral de Proteção de Dados) regulations. Additionally, the leakage of personal customer data increases the risk of identity theft and targeted phishing attacks directed at the affected clients.

For organizations operating in the professional services and digital identity sectors, maintaining robust security postures is essential. Common defensive steps to mitigate such risks include implementing multi-factor authentication (MFA) to protect against the use of stolen credentials, maintaining strict network segmentation to prevent lateral movement, and conducting regular audits of access logs. Continuous monitoring and rapid incident response capabilities are also vital to detecting and containing unauthorized exfiltration attempts before they reach a critical scale.

Information regarding the Babuk2 group remains limited in the public domain, making it difficult to determine the full scope of their operational methods or their long-term objectives.