Mpaj.gov.my targeted by Babuk2 ransomware group

• Ransomware group: Babuk2
• Country: Malaysia
• Sector: Government & Defense
• Announcement date: March 21, 2025

Babuk2 claims data breach at Mpaj.gov.my

The threat actor known as Babuk2 has announced that they have leaked a significant amount of data allegedly belonging to the Ampang Jaya Municipal Council (Mpaj.gov.my) in Malaysia. According to the announcement made on a leak site on March 21, 2025, the group claims to have gained unauthorized access to the institution's systems, resulting in the compromise of a large dataset.

The group's claim suggests that the breach occurred on the same day the announcement was posted, March 21, 2025. This type of activity is characteristic of modern ransomware operations, where threat actors often employ double extortion tactics. In these scenarios, attackers do not merely encrypt an organization's files to disrupt operations but also exfiltrate sensitive information to use as leverage. By threatening to release this data on a public leak site, the group attempts to exert maximum pressure on the victimized institution to meet their demands.

Details of the alleged data theft

The Babuk2 group claims to have stolen a dataset consisting of approximately 90 GB of information, comprising 1,155 files. The volume and variety of the data described suggest a significant breach of the institution's digital environment. The group's primary objective in publishing such a listing appears to be the public exposure of the data to increase the pressure on the target organization.

The alleged data includes a wide range of sensitive information that could impact both the institution and the individuals involved. The specific data types mentioned in the claim include:

• Names
• Phone numbers
• Identity card numbers
• Addresses
• Emails
• Passwords
• Administrative personal information
• Tax transactions
• Audit data
• Contract data
• Transaction details

About Mpaj.gov.my

Mpaj.gov.my is the official website of the Ampang Jaya Municipal Council, which is located in the state of Selangor, Malaysia. This institution is responsible for managing various local government services, including urban planning and public administration within the Ampang Jaya area. As a government entity, it handles a vast amount of sensitive information related to the citizens and the administrative functions of the region.

Potential impact and organizational security

This alleged leak may pose a substantial risk due to the exposure of personal data belonging to both citizens and employees within the institution. The nature of the compromised data—which includes identity card numbers, passwords, and contact details—creates a high risk that the information could be utilized for identity theft or targeted phishing attacks against the individuals involved. Furthermore, the exposure of administrative, tax, and audit data could have negative impacts on the operational security and integrity of the institution.

From a regulatory perspective, the institution may face legal processes under Malaysian data protection regulations following such an incident. While information regarding the specific capabilities and history of the Babuk2 group remains limited, the impact of their actions can be far-reaching. For organizations in the government and public sector, maintaining robust security postures is critical to protecting sensitive citizen data.

To defend against such threats, organizations typically focus on implementing multi-factor authentication, maintaining rigorous patch management schedules, and conducting regular security audits. Additionally, robust data encryption and comprehensive monitoring of network traffic can help detect unauthorized exfiltration attempts. Protecting the operational security of a public institution requires continuous vigilance to prevent the exposure of sensitive administrative and personal records.