mtgazeta.uz targeted by Babuk ransomware group in data leak claim

• Ransomware group: Babuk2
• Country: Uzbekistan
• Announcement date: January 27, 2025

Babuk ransomware group claims data leak of mtgazeta.uz

The Babuk ransomware group has published an announcement on its leak site claiming to have leaked 3 GB of data belonging to mtgazeta.uz. This announcement, which appeared on January 27, 2025, suggests a significant breach of the digital assets associated with the organization. The threat actors claim to have targeted the institution on the same day the announcement was made.

In many modern ransomware campaigns, threat actors employ a tactic known as double extortion. In this scenario, attackers do not merely encrypt an organization's data to disrupt operations; they also exfiltrate sensitive information before the encryption process begins. The threat of releasing this stolen data on a public leak site serves as additional leverage to pressure the victim into paying a ransom. While the specific ransom demand for this incident has not been disclosed, the publication of a data sample is a common method used by such groups to prove the validity of their claims.

Details of the alleged breach

According to the announcement made by the Babuk group, the attackers have successfully obtained sensitive components of the organization's infrastructure. Specifically, the group claims to have accessed the source code of the institution's FTP server as well as its databases. To support their claims, the threat actors shared a 200 MB sample file containing a portion of the allegedly stolen data.

The content of the alleged data breach is diverse, involving critical technical assets that could compromise the integrity of the platform. The items identified in the claim include:

• Source code
• Databases
• Configuration files
• Secret keys

The exposure of such technical details, particularly secret keys and configuration files, presents a severe security challenge. These elements are often used to authenticate services or manage system settings, and their compromise can provide attackers with a roadmap for further exploitation.

About mtgazeta.uz

mtgazeta.uz is a news and media platform based in Uzbekistan. The organization serves its audience by publishing current news and local content, making it a significant part of the digital media landscape within its region.

Security implications and organizational risks

This leak claim suggests that the institution's digital infrastructure and sensitive system information may be at risk of exposure. The publication of source code is particularly concerning, as it may facilitate the identification of security vulnerabilities in the platform, thereby increasing the likelihood of future targeted attacks. Furthermore, the exposure of secret keys and configuration files could potentially lead to secondary attacks or unauthorized access to other systems within the institution.

For organizations operating in the media and news sector, the exposure of data can negatively impact operational continuity and create long-term security risks. Such incidents often require a comprehensive forensic investigation to determine the full extent of the breach and to ensure that all unauthorized access points have been closed. Defensive measures typically involve implementing strict access controls, employing multi-factor authentication, and conducting regular audits of configuration files and secret keys to prevent unauthorized exposure.

Publicly available information regarding the Babuk group remains limited. However, the nature of this claim highlights the ongoing threat posed by ransomware groups that target digital infrastructure to extract high-value technical assets. The potential for secondary exploitation following such a leak necessitates a proactive approach to cybersecurity and incident response management.