Municipal taxation Secretariat access claimed by babuk2

• Ransomware group: babuk2
• Country: Brazil
• Sector: Government & Defense
• Announcement date: March 19, 2025

The threat actor known as babuk2 has posted an announcement on its leak site claiming to have compromised the Municipal taxation Secretariat in Brazil. According to the group's post, the breach involves significant access to the institution's systems and the theft of a substantial amount of data.

Details of the claimed attack

On March 19, 2025, the babuk2 group published an announcement stating they have obtained access to a web panel and various database files belonging to the institution. To support their claim, the group provided a screenshot that appears to show an administrative panel used for the institution's tax system. This type of evidence is frequently used by ransomware groups to demonstrate the legitimacy of their intrusion to both the victim and the public.

The post also included specific instructions for the victim, detailing how to contact the group through encrypted messaging platforms. This method of communication is a standard practice for ransomware groups operating on leak sites, allowing them to conduct negotiations while attempting to maintain anonymity. While the group's claims are significant, public information regarding the specific operations and background of the babuk2 group remains limited.

Data and systems involved

The group claims to be in possession of a 100 GB dataset. This dataset is stated to include database records belonging to the Secretariat. The evidence provided by the attacker includes a screenshot of a web interface titled 'Portal Directa,' which the group suggests may contain personal data belonging to taxpayers. The breach, as claimed by the threat actor, impacts the following areas:

• Taxpayer records
• Database access credentials

In many modern cyberattacks, particularly those involving ransomware, groups employ a tactic known as double extortion. In this scenario, attackers do not just encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive data before the encryption occurs. The threat of leaking this stolen information on a public forum serves as additional leverage to pressure the victim into paying a ransom. If the claimed data is indeed leaked, it could lead to secondary consequences for the individuals whose information is contained within the files.

Potential impact and risks

This incident poses a significant risk due to the potential exposure of sensitive tax data belonging to a public institution. If the claimed data is leaked, taxpayers could be subject to identity theft or targeted phishing attacks. Furthermore, the institution may face legal sanctions under Brazil's data protection law (LGPD) due to the potential compromise of sensitive information.

The claimed access could lead to a compromise of the institution's digital infrastructure and facilitate secondary attacks. When administrative panels or database credentials are exposed, it provides a roadmap for further unauthorized access and lateral movement within a network. This can lead to a complete compromise of the digital environment and long-term persistence by the attacker.

Defensive considerations for public institutions

Organizations within the government and defense sectors, which manage vast amounts of sensitive citizen data, can take several steps to mitigate the risks associated with such attacks. Implementing robust multi-factor authentication (MFA) across all administrative panels and remote access points is a critical defense against credential theft. Additionally, strict network segmentation can prevent an attacker from moving laterally from a web interface to sensitive database servers.

Continuous monitoring of administrative access and the implementation of data loss prevention (DLP) tools can help detect unauthorized exfiltration attempts. Finally, ensuring that all systems are patched against known vulnerabilities and that database access is strictly controlled through the principle of least privilege can significantly reduce the attack surface available to threat actors.