Baykar Turkish defense company targeted by Babuk2 ransomware group

• Ransomware group: Babuk2
• Country: Türkiye
• Sector: Manufacturing
• Announcement date: March 12, 2025

Babuk2 group claims data leak involving Baykar

The Babuk2 ransomware group has published an announcement on its leak site claiming to have leaked data belonging to Baykar, a Turkish defense company specializing in C4I and artificial intelligence. The announcement, which was posted on March 12, 2025, suggests a significant breach of corporate information and infrastructure.

According to the claims made by the threat actors, the group managed to gain unauthorized access to the company's management panel. This access allegedly allowed them to obtain various types of corporate data. Furthermore, the group alleges that they have successfully gained access to the company's broader infrastructure and have managed to compromise certain social media accounts belonging to the organization.

Details of the alleged data compromise

The announcement made by the Babuk2 group specifies several categories of sensitive information that they claim to have obtained during their intrusion. While the specific volume of the data and the total number of files involved have not been disclosed, the group has identified several specific types of information that are supposedly included in the leak.

The information allegedly compromised includes:

• Employee lists
• Product lists
• Administrator usernames and passwords

In addition to these lists, the group claims to possess access credentials pertaining to the company's infrastructure. The presence of administrator usernames and passwords in such a leak is particularly critical, as these credentials can provide high-level permissions within a network environment.

Organization profile: Baykar

Baykar is a Turkish defense company that focuses on C4I (Command, Control, Communications, Computers, and Intelligence) and artificial intelligence. The company operates within the manufacturing sector and is a significant entity in the defense industry.

Impact and security implications

The claims made by the Babuk2 group pose substantial risks to the organization's operational security and its intellectual property rights. The alleged compromise of administrator passwords is a particularly severe development, as such credentials could be utilized to facilitate secondary attacks against the company's network, allowing attackers to move laterally or escalate privileges.

Because the entity operates within the defense industry, this situation may raise significant concerns regarding supply chain security and national security. Breaches in this sector often have implications that extend beyond the individual organization, potentially impacting broader defense networks and national interests. Furthermore, such an incident may trigger legal processes under the scope of data protection regulations, such as the KVKK (Personal Data Protection Law).

Ransomware groups often employ a strategy known as double extortion, where they not only encrypt an organization's data to demand a ransom for its decryption but also threaten to leak stolen information on public leak sites to pressure the victim. This tactic increases the pressure on organizations to comply with ransom demands to avoid the public exposure of sensitive corporate or personal data.

In response to such threats, organizations typically focus on strengthening their defensive posture. Common defensive steps include implementing multi-factor authentication (MFA) to protect administrative accounts, maintaining rigorous patch management to close vulnerabilities, and conducting regular security awareness training for employees. Additionally, robust network segmentation and continuous monitoring of infrastructure can help detect and contain unauthorized access before it escalates into a full-scale data breach. Information regarding the Babuk2 group remains limited at this time.