Babuk2 ransomware group lists www.constelacion.com.sv on its leak site

• Ransomware group: Babuk2
• Country: El Salvador
• Sector: Technology
• Announcement date: January 27, 2025

Babuk2 claims data breach at Constelación

The Babuk2 ransomware group has announced on its leak site that it has published data allegedly belonging to Constelación, a technology and IT services provider based in El Salvador. According to the announcement made on January 27, 2025, the threat actors claim to have exfiltrated a significant volume of information following a failed negotiation process. The group's claim suggests that the data was released after the institution allegedly rejected ransom demands.

In their announcement, the Babuk2 threat actors provided specific criticisms regarding the victim's security posture. The group alleged that the institution's network security was weak and that its backup systems were insufficient to prevent or recover from the intrusion. This type of rhetoric is common in ransomware attacks, where threat actors attempt to pressure organizations by highlighting perceived vulnerabilities in their infrastructure.

Details of the claimed data theft

The announcement made by the Babuk2 group specifies that the stolen data volume is approximately 470 GB. While the exact file count has not been disclosed, the group claims that the leaked information is highly sensitive, encompassing both internal corporate communications and information related to the company's clients. This type of double extortion tactic—where data is both encrypted and stolen to be used for public exposure—is a primary driver for modern ransomware operations.

The data types allegedly compromised include:

• Customer data
• Internal communications

The public availability of such data can lead to significant reputational damage and may cause disruptions to the institution's commercial activities. Furthermore, the exposure of customer information can create opportunities for secondary attacks, such as identity theft or targeted phishing campaigns against the affected individuals.

About Constelación

Constelación is a technology and IT services company located in El Salvador. The organization is involved in providing various digital solutions and technological infrastructure support to its various clients. Given its role in providing technological services, the organization plays a critical part in the digital operations of the entities it supports.

Potential impacts and industry implications

The allegations made by the Babuk2 group may pose substantial risks to the institution's operational continuity and the privacy of its customers. Because the organization operates within the technology sector and supports various clients, the breach could have cascading effects. Specifically, since the institution operates in the financial sector, the leak allegations may lead to investigations by local regulatory bodies and the potential for legal sanctions.

In the broader context of cybersecurity, such incidents highlight the critical importance of robust defensive measures. Organizations in the technology and service sectors often implement several defensive steps to mitigate these risks, such as maintaining offline, immutable backups to counter insufficient backup systems, implementing strict network segmentation to address weak network security, and utilizing multi-factor authentication to protect internal communications. The exposure of sensitive data remains a primary method for threat actors to exert pressure during extortion attempts.

The limited public information available regarding the specific mechanics of the Babuk2 group makes it difficult to determine the exact nature of the intrusion. However, the claim that internal communications and customer data were compromised underscores the necessity for organizations to prioritize data encryption and rigorous access controls to prevent unauthorized exfiltration.