Workers.com.zm listed on Babuk2 ransomware leak site

• Ransomware group: Babuk2
• Country: Zambia
• Sector: Professional Services
• Announcement date: January 27, 2025

The Babuk2 ransomware group has officially claimed responsibility for a data leak involving the organization workers.com.zm. According to an announcement made on the group's leak site, the threat actor alleges that sensitive information belonging to the entity has been compromised and made available for public download.

The alleged data breach event

The incident was brought to light on January 27, 2025, when the Babuk2 threat actor listed workers.com.zm on its dedicated leak site. The group alleges that it has successfully obtained various database tables belonging to the organization. To support their claims, the attackers provided a link intended for downloading the alleged data, a common tactic used by ransomware groups to demonstrate the validity of their breach to both the victim and the public.

Ransomware groups often employ a strategy known as double extortion. In these scenarios, attackers do not merely encrypt an organization's files to disrupt operations; they also exfiltrate sensitive data before the encryption process begins. By threatening to release this stolen information on a public leak site, the attackers aim to increase pressure on the victim to pay a ransom, leveraging the threat of reputational damage and regulatory scrutiny.

Details of the claimed data exposure

The announcement made by the Babuk2 group specifies several types of data that are allegedly included in the leak. The group claims that the stolen information contains specific database tables and sensitive security credentials. According to the post, the following elements are part of the leaked dataset:

• Database tables
• Administrative notes
• Action logs
• Secret hash data

The inclusion of specific technical identifiers, such as wp_wc_admin_notes, wp_actionscheduler_actions, and wp_actionscheduler_claims, suggests that the attackers may have targeted specific database structures. Furthermore, the claim that secret hash data was obtained is particularly significant for the security posture of the affected organization.

Impact and security implications

This incident indicates that the organization's digital assets may have been exposed to unauthorized access. The alleged leak of hash values and administrative records could facilitate further attacks against the organization's infrastructure. When sensitive technical data, such as hashes or administrative logs, becomes public, it provides a roadmap for subsequent malicious activities, potentially allowing attackers to attempt credential cracking or deeper lateral movement within the network.

Furthermore, the public availability of such data may increase the risk of identity theft and phishing attacks for the employees served by the organization. When administrative notes or action logs are exposed, attackers can craft highly convincing social engineering campaigns tailored to the specific workflows and internal communications of the target.

General defensive considerations

While information regarding the Babuk2 group remains limited and the validity of their claims should be verified by independent sources, this event highlights the ongoing risks faced by professional services organizations. To mitigate the risks associated with such breaches, organizations typically focus on several defensive pillars. Implementing robust access controls and multi-factor authentication can help prevent unauthorized entry. Additionally, regular auditing of database access and the encryption of sensitive data at rest can reduce the utility of stolen information.

Defending against modern ransomware requires a multi-layered approach. Organizations often implement continuous monitoring to detect unusual data exfiltration patterns and maintain offline, immutable backups to ensure recovery in the event of a successful encryption attack. As threat actors continue to refine their methods, staying informed about the specific tactics, techniques, and procedures used by groups like Babuk2 is essential for maintaining a proactive security posture.