Exostar.com TOP Defense AS targeted by babuk2 ransomware group

• Ransomware group: babuk2
• Country: United States
• Sector: Technology
• Announcement date: March 21, 2025

The babuk2 ransomware group has announced a significant data breach involving exostar.com TOP Defense AS. According to an announcement made on the group's leak site on March 21, 2025, the threat actors claim to have successfully exfiltrated a substantial amount of sensitive information from the organization's systems.

The claimed attack and exfiltration

The babuk2 group officially declared its targeting of exostar.com TOP Defense AS on March 21, 2025. In their announcement, the group claims to have stolen approximately 700 GB of data from the organization. This type of activity is characteristic of modern ransomware operations, often referred to as double extortion, where attackers not only encrypt an organization's systems but also steal sensitive data to use as leverage for ransom demands.

In such scenarios, ransomware groups typically post announcements on dedicated leak sites to pressure victims. These sites serve as a public stage for the attackers to demonstrate their success and increase the visibility of the breach. While the group has made these claims, the specific details regarding the methods used to gain access to the network remain undisclosed in the public domain.

Details of the allegedly compromised data

The data allegedly stolen by the babuk2 group is reported to be highly sensitive, covering various aspects of the organization's operations. The group claims that the exfiltrated information includes a wide range of internal documentation and administrative records. Based on the announcement, the compromised data types include:

• Financial records
• Contracts
• Access credentials
• Technical support requests
• Email correspondence

To support their claims, the group has provided visual evidence in the form of screenshots. These images reportedly display examples of internal email correspondence and user access management panels, suggesting that the breach may have granted the attackers visibility into the organization's internal communications and administrative interfaces.

Organizational profile

Exostar is a technology company that provides cloud-based identity and access management solutions for highly regulated industries such as aerospace, defense, and life sciences. The company specializes in supply chain collaboration and secure data sharing.

Risk assessment and industry implications

This incident may pose a significant risk to the organization's operational security and the confidentiality of client data. Given the sensitive nature of the data involved, secondary security risks to the organization's partners and the broader supply chain may be observed. Because Exostar operates within highly regulated sectors, the disclosure of this data to third parties could lead to regulatory sanctions, depending on the applicable industry standards and compliance requirements.

Furthermore, the exposure of leaked email and access credentials could be utilized by malicious actors for targeted phishing attacks against the organization's personnel. Such attacks often leverage stolen information to gain further unauthorized access or to conduct social engineering campaigns.

For organizations operating in critical technology and defense sectors, maintaining robust security postures is essential. Common defensive steps to mitigate such risks include implementing multi-factor authentication (MFA) to protect access credentials, maintaining strict network segmentation to limit lateral movement, and conducting regular security awareness training to defend against phishing. Additionally, continuous monitoring of network traffic and proactive threat hunting can help identify unauthorized data exfiltration attempts before they reach a critical scale.

Information regarding the babuk2 group remains limited in the public domain, making it difficult to ascertain their full capabilities or long-term objectives beyond their recent claims.