Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Enjoying ransomware.live? Help us keep tracking ransomware gangs and shipping new features. Support us

Babuk2 (Impersonator) – Credential-Stuffing Wave Following a Leak-Site Claim

Babuk2 Initial Access Sentinel
MITRE ATT&CK
Password Spraying
Data Source
SigninLogs
Date Added
2026-07-23
Last Updated
2026-07-23
Source
ransomware.live group profile (babuk2) – group has no confirmed intrusion TTPs of its own; generic post-leak credential-abuse hunt, not a group-specific tool signature
What This Detects
Babuk2 (aka Bjorka/SkyWave) does not appear to compromise victims directly – it repackages already-public breach data from forums under a ransomware brand. The closest defensively-relevant signal is a credential-stuffing/spraying wave against your tenant shortly after a new leak-site claim naming your organization.
Query
SigninLogs
| where TimeGenerated > ago(1d)
| where ResultType != "0"
| summarize FailedAttempts = count(), DistinctIPs = dcount(IPAddress) by UserPrincipalName, bin(TimeGenerated, 1h)
| where FailedAttempts > 20 and DistinctIPs > 5
| join kind=inner (
    SigninLogs
    | where TimeGenerated > ago(1d)
    | where ResultType == "0"
    | project UserPrincipalName, SuccessTime = TimeGenerated, IPAddress
) on UserPrincipalName

Hunting queries are starting points for threat hunting & detection engineering — validate table/column names against your own workspace schema and tune thresholds before turning any of these into a production alert rule.