Skopje.gov.mk targeted by babuk2 ransomware group

• Ransomware group: babuk2
• Country: North Macedonia
• Sector: Government & Defense
• Announcement date: January 27, 2025

Babuk2 claims to have obtained administrative access to Skopje.gov.mk

On January 27, 2025, the threat actor known as babuk2 published a leak announcement involving the City of Skopje (skopje.gov.mk). The group has claimed to have obtained administrative access credentials belonging to the institution. While the group has made this claim on a leak site, information regarding the specific identity and background of this threat actor remains limited.

Ransomware groups often utilize leak sites to pressure victims into paying ransoms. These sites serve as a public platform where attackers post announcements regarding their targets, often accompanied by proof of the breach to increase psychological pressure on the victim organization. In this instance, the announcement includes alleged administrative access credentials for skopje.gov.mk and a download link provided by the attacker.

Details of the claimed breach

The threat actor's announcement focuses on the acquisition of high-level access rather than a specific volume of files. According to the claim, the following information has been compromised:

• Administrative access credentials

The group has demanded a ransom of 2.000 USD in relation to this incident. The announcement type is categorized as a data breach (veri sızıntısı), and the claimed attack date aligns with the date the announcement was made on the leak site, which is January 27, 2025.

The target organization

The target of this alleged attack is skopje.gov.mk, which represents the City of Skopje. As the local government body of Skopje, the capital of North Macedonia, this institution is responsible for managing the city's administrative affairs, urban planning, and various public services. Due to its role in managing municipal operations and public services, the organization serves as a critical component of the local government infrastructure.

Analysis and potential implications

The claim made by babuk2 suggests that unauthorized access to the institution's digital infrastructure may have been achieved. The exposure of administrative credentials is a critical security failure, as such information could compromise the entire network security of the institution and potentially lead to secondary attacks. When administrative credentials are leaked, attackers gain the ability to move laterally through a network, escalate privileges, and maintain long-term persistence.

Because the target is a government entity, this situation poses significant risks to the confidentiality of citizen data and the continuity of essential public services. A successful breach of this nature could trigger legal processes under the data protection regulations established in North Macedonia. The specific ransom demand made by the threat actor suggests that they may be pursuing a double-extortion strategy. In double-extortion tactics, attackers not only encrypt systems to disrupt operations but also steal sensitive data to threaten the victim with its public release, thereby increasing the likelihood of payment.

For organizations operating within the government and defense sectors, maintaining robust security postures is vital to protect public trust and operational integrity. Common defensive measures include implementing multi-factor authentication (MFA) to protect administrative accounts, enforcing the principle of least privilege to limit the impact of compromised credentials, and maintaining rigorous monitoring of network traffic to detect unauthorized access attempts. Additionally, regular security audits and incident response planning are essential to mitigate the impact of potential breaches and ensure the continuity of critical public services.