Babuk and Leaked Builder Variants Guide: Triage unknown lockers and defend ESXi

When Babuk's builder source code leaked in September 2021, one ransomware operation became a free toolkit, and many of the unfamiliar lockers now hitting VMware ESXi hosts trace back to it. That matters in an incident: a ransom note with an unknown brand may be a Babuk derivative, which changes how you attribute it, which decryptors are worth checking and what the operator is likely to do next. This profile covers the original Babuk operation, the leak and the families built from it, the ATT&CK techniques defenders see, how the operators use identities, the public law enforcement and decryption milestones, and the detections and controls that matter most for hypervisors. It is for incident responders, threat intelligence analysts and virtualisation administrators. It is defensive only and contains no builder, encryption or payload detail. For the hands-on response steps, use the ESXi Ransomware Playbook.

Key takeaways

• A leak turns a brand into a code base. After the September 2021 leak, SentinelLABS identified ten ransomware families with ESXi lockers based on Babuk code that appeared between the second half of 2022 and the first half of 2023.
• Family is not attribution. Babuk-derived code has been used by unrelated groups, from a China-based actor ATT&CK calls Cinnamon Tempest to brands linked to Play and RansomHouse, so name the operator from infrastructure and tradecraft, not from code lineage.
• Check decryptors early. Talos and Avast added keys recovered by law enforcement to a generic Babuk decryptor on No More Ransom; some derivatives reused a single key pair for every victim.
• The hypervisor is the blast radius. Derivatives stop guest virtual machines and encrypt their files on the host, so one administrative credential for vCenter or ESXi can take down hundreds of servers at once.
• Identity controls on management planes stop most of it. These lockers run after the operator has valid administrative access, so MFA on vCenter, no shared root passwords, disabled SSH and isolated management networks remove the precondition.

Who they are (names and aliases)

Babuk is a malware family and, originally, a ransomware operation. ATT&CK v20 records it as Babuk (S0638), with aliases Babyk and Vasa Locker, and describes it as ransomware-as-a-service used since at least 2021, with operators who targeted large enterprises in a "big game hunting" approach and ran a leak site for stolen data. The US Department of Justice, announcing indictments on 16 May 2023, said Babuk actors carried out more than 65 attacks worldwide, made more than 49 million US dollars in ransom demands and received up to 13 million US dollars in payments. Victims named in that announcement include the Metropolitan Police Department in Washington DC, hit on 26 April 2021.

The leak of the builder source code in September 2021 created a second meaning: "Babuk-based" now describes any locker built from that code. Families publicly linked to the leaked code include the following.

Two cautions. First, SentinelLABS found that ESXiArgs, the February 2023 mass campaign, was wrongly linked to Babuk, so not every ESXi locker is a derivative. Second, lineage claims come from vendor code comparison and can change; record the source and date when you write lineage into a report. See the Ransomware Family Lineage and Rebrands Guide for how to handle rebrands and forks.

Targeting and motivation

• Original Babuk: financially motivated big game hunting with double extortion through a leak site against large enterprises, and, per the DOJ, public bodies such as a city police department.
• Criminal reuse: established groups used the leaked code to get a working ESXi locker without building one. SentinelLABS links ESXi lockers associated with Play and RansomHouse to it. See the Play Ransomware Profile.
• Low-skill operators: the Tortilla actor exploited known Exchange flaws and used one key for everyone, the mark of someone who compiled leaked code without changing much.
• Possibly non-financial motives: ATT&CK describes Cinnamon Tempest as acting independently across the whole attack lifecycle without affiliates and, based on victimology, short variant lifespans and use of malware attributed to government-sponsored groups, possibly motivated by intellectual property theft or espionage rather than ransom.

The defensive implication is that a Babuk-derived note can front anything from a ransom-only crime to an espionage operation using encryption as cover. Preserve evidence of exfiltration and earlier access even when a decryptor works.

Tactics and techniques (MITRE ATT&CK)

The table combines techniques ATT&CK v20 maps to Babuk (S0638) with the access steps described in the cited reporting. Derivatives vary, so treat this as the expected pattern, not a fixed list.

Verify current mappings on the ATT&CK software page; ATT&CK v20 retired the old Impair Defenses technique in favour of T1685.

How they abuse identities and credentials

An ESXi locker is only the last step. Every derivative needs an identity with enough privilege to reach the hypervisor, and that is where defenders have leverage.

• Directory-joined virtualisation: where vCenter trusts Active Directory, a stolen domain account in an administrators group (T1078.002) gives the attacker the whole virtual estate. Use a separate identity source or a dedicated admin forest for the management plane.
• Shared root passwords: the same ESXi root password on every host lets one recovered credential reach all of them. Use unique per-host credentials held in a vault and rotated after each use.
• Service accounts with broad rights: backup software, monitoring and automation tools often hold vCenter administrator rights. If the attacker takes the backup service account they can both encrypt hosts and delete restore points. See the Service Account Security Guide.
• Exposed Exchange or VPN identities: the Tortilla case started from a public-facing server; harvested credentials from such footholds then become valid accounts elsewhere.

Notable incidents

• April 2021, Metropolitan Police Department, Washington DC: attacked with Babuk on 26 April 2021, per the DOJ.
• September 2021, builder leak: the source code leaks, giving any actor a Windows and ESXi capable locker.
• Late 2021, Tortilla campaign: Talos reports a Babuk variant deployed through ProxyShell on vulnerable Exchange servers.
• 2022 onwards, Cinnamon Tempest: ATT&CK records a series of short-lived Babuk-based brands, including Cheerscrypt against ESXi and Windows.
• Second half of 2022 to first half of 2023: SentinelLABS counts ten families with Babuk-based ESXi lockers.
• 16 May 2023, indictments and sanctions: the DOJ unseals indictments covering Babuk, LockBit and Hive activity, and the US Treasury's Office of Foreign Assets Control sanctions the defendant the same day. See the Ransomware Payments and Sanctions Guide for why sanctions matter if anyone considers paying.
• 9 January 2024, Tortilla decryptor: after Dutch police arrested the Tortilla actor, Talos extracted the private key from the actor's decryptor and Avast added it to its generic Babuk decryptor, available from No More Ransom.

Detection and defence

Triage an unknown locker

1. Preserve first: snapshot or copy an encrypted VM disk, the ransom note and any binary found, and export vCenter and ESXi logs before rebuilding. See the ESXi Logs Detection Guide.
2. Classify in a sandbox or through your vendor: submit samples to a malware analysis service or your EDR provider to establish lineage; do not run unknown binaries in production.
3. Check decryptors: search No More Ransom for the family and test the generic Babuk decryptor on a copy of an encrypted file, never on originals.
4. Attribute separately: look for exfiltration, leak site listings and earlier intrusion artefacts to name the operator; see the Ransomware Data Leak Site Listing Playbook.
5. Scope the identity: find which account reached vCenter or ESXi and treat every system that account could reach as exposed.

Detections that work across derivatives

Controls

• Isolate the management plane: put vCenter and ESXi management interfaces on a dedicated network reachable only from privileged access workstations or a jump host.
• Harden hosts: keep SSH and ESXi Shell disabled by default, use lockdown mode where operations allow, and patch hypervisors and vCenter promptly.
• Protect admin identities: phishing-resistant MFA for vCenter, no standing administrator rights, unique vaulted root credentials. See the Privileged Access Management Guide.
• Patch public-facing servers: the Tortilla case used ProxyShell, long after patches existed; KEV-listed flaws on internet-facing systems need priority.
• Make backups survive the admin: immutable or offline copies managed under separate credentials, with restores tested (NIST CSF 2.0 PR.DS-11, RC.RP-03). See the Ransomware Prevention Guide.

Metrics

• Percentage of ESXi hosts with SSH disabled and lockdown mode on.
• Number of accounts with vCenter administrator rights, and how many are standing rather than just-in-time.
• Time to restore a representative set of VMs from immutable backup in the last test.
• Percentage of ESXi and vCenter logs forwarded to the SIEM.
• Time from KEV listing to patch for internet-facing servers.

Framework mapping

Practitioner checklist

• Add Babuk (S0638) and its aliases to your threat profile, with a note that the code is public and used by many groups.
• Bookmark the No More Ransom Babuk decryptor and test it on copies during triage.
• Disable SSH and ESXi Shell by default and alert when they are enabled.
• Move vCenter administration off general domain accounts and require phishing-resistant MFA.
• Replace shared ESXi root passwords with unique, vaulted credentials.
• Scope backup service accounts so they cannot delete immutable copies.
• Forward vCenter and ESXi logs to the SIEM and alert on mass VM power-off.
• Record lineage claims with their source and date, and attribute operators separately.

Standards and references

• MITRE ATT&CK: Babuk (S0638)
• MITRE ATT&CK: Cinnamon Tempest (G1021)
• MITRE ATT&CK: Cheerscrypt (S1096)
• US Department of Justice: Russian National Charged for Ransomware Attacks Against Critical Infrastructure
• Cisco Talos: Decryptor for Babuk Tortilla released
• SentinelLABS: Multiple threat actor groups hop on leaked Babuk code to build ESXi lockers
• CISA: Known Exploited Vulnerabilities Catalog

Related NHI Mgmt Group resources: ESXi Ransomware Playbook · Ransomware Family Lineage and Rebrands Guide · Ransomware Groups Guide · ESXi Logs Detection Guide · Ransomware Response and Recovery Guide