Smic.mi.th (Thailand Intelligence Agency) targeted by Babuk2 ransomware group

• Ransomware group: Babuk2
• Country: Thailand
• Sector: Government & Defense
• Announcement date: March 20, 2025

Babuk2 claims data leak at Thailand Intelligence Agency

The Babuk2 ransomware group has posted an announcement on its leak site claiming that it has successfully compromised the data of smic.mi.th, the Strategic Intelligence Center of the Royal Thai Armed Forces. According to the threat actor, the breach involves a massive volume of stolen information, with the group alleging that approximately 537 million pieces of data have been taken from the organization.

In the announcement made on March 20, 2025, the threat actor stated that they have gained access to the organization's internal data. The group has indicated that they are providing the agency with an opportunity to rectify its mistakes before they proceed with the full publication of the stolen information. This tactic is a hallmark of modern ransomware operations, where attackers use the threat of data exposure to pressure victims into meeting their demands.

Details of the alleged data breach

While the specific nature and exact contents of the leaked data have not been explicitly detailed in the provided screenshots, the threat actor has provided a list of potential file types that may be included in the stolen dataset. The claim suggests that the stolen information consists of various common document and data formats.

The file types mentioned in the claim include:

• .xlsx files
• .txt files
• .doc files
• .pdf files

The group has not specified the exact size of the data or the specific nature of the files beyond these extensions. Furthermore, no information has been provided regarding a specific ransom demand or the exact date the initial compromise occurred, though the announcement itself was posted on March 20, 2025.

The targeted organization

The target of this alleged attack is smic.mi.th, which serves as the Strategic Intelligence Center operating under the Royal Thai Armed Forces. This agency is responsible for critical national security functions, including intelligence gathering, analysis, and assessment tasks intended to support the defense and security of Thailand.

Security implications and risks

The claim of a data leak targeting a national intelligence agency poses significant risks to national security. Depending on the actual nature of the data involved, such a breach could potentially lead to the exposure of state secrets or sensitive operational information. Such an event could result in substantial reputational damage to the agency and create vulnerabilities within the national security framework.

The threat actor's warning that they will publish the data if the organization does not act highlights the risk of double extortion. In double extortion scenarios, attackers do not just encrypt data to disrupt operations; they also steal sensitive information to use as leverage, threatening to leak it publicly to increase the pressure on the victim to pay the ransom.

For organizations operating within the government and defense sectors, such incidents underscore the necessity of robust defensive postures. Common defensive steps for high-value targets include implementing strict access controls, maintaining comprehensive logging and monitoring to detect unauthorized movement, and ensuring rigorous patch management to close vulnerabilities. Because public information regarding the Babuk2 group remains limited, organizations must remain vigilant against evolving tactics used by such threat actors.