Babuk2 ransomware group lists www.avantit.no on its leak site

• Ransomware group: Babuk2
• Country: Norway
• Sector: Technology
• Announcement date: January 27, 2025

The Babuk2 ransomware group has listed data allegedly belonging to the Norway-based technology company Avant IT on their leak site. This announcement, made on January 27, 2025, marks a new incident involving the threat actor group and the Norwegian firm.

The claimed attack and event details

According to the announcement posted on the group's leak site, the Babuk2 group claims to have gained access to the organization's domain controller (DC) data. This specific type of access is often a critical stage in a cyberattack, as domain controllers serve as central hubs for managing identity and security policies within a network.

The group officially listed the entity on their site on January 27, 2025, which coincides with the date they claim the attack occurred. While the group has made these claims, the incident remains an allegation from the threat actor's side. The announcement includes a list of various servers and workstations that the group claims belong to the organization's network.

Data involved in the listing

The information provided by the threat actor includes a screenshot that displays a list of devices claimed to belong to the organization's network. This list consists of several types of hardware and infrastructure components. Specifically, the listing names the following affected data types:

• Network device lists

Despite the presence of this list, there is no detailed information regarding the specific content of the allegedly leaked data. No information was provided regarding the total size of the data, the specific file count, or the nature of the files themselves. Furthermore, there was no mention of a ransom demand in the announcement.

Organization profile

Avant IT is a Norway-based information technology company. The firm provides IT consulting, system integration, and digital infrastructure solutions to businesses.

Analysis and implications

This incident suggests that the organization's network infrastructure and server information may have been compromised by threat actors. The leaked data, specifically the lists of devices, could potentially be used to map the organization's network topology. Such mapping is a common precursor to facilitating future targeted attacks, as it provides a blueprint of the internal environment.

The use of double extortion tactics may be intended to increase pressure on the organization. Double extortion is a common ransomware strategy where attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to threaten its public release. This creates a secondary layer of leverage for the criminals.

As an entity operating in Norway, the organization may face data protection obligations under the GDPR. Organizations in the technology sector often deal with complex infrastructures, making them high-value targets for various threat actors. While information about the Babuk2 group is limited, the incident highlights the ongoing risks faced by IT service providers. To defend against such threats, organizations typically implement defensive steps such as robust identity management, regular monitoring of domain controller logs, and strict network segmentation to limit lateral movement.