Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Babuk2 (Impersonator) – Credential-Stuffing Wave Following a Leak-Site Claim

Babuk2 Initial Access Sentinel
MITRE ATT&CK
Password Spraying
Data Source
SigninLogs
Date Added
2026-07-23
Last Updated
2026-07-23
Source
ransomware.live group profile (babuk2) – group has no confirmed intrusion TTPs of its own; generic post-leak credential-abuse hunt, not a group-specific tool signature
What This Detects
Babuk2 (aka Bjorka/SkyWave) does not appear to compromise victims directly – it repackages already-public breach data from forums under a ransomware brand. The closest defensively-relevant signal is a credential-stuffing/spraying wave against your tenant shortly after a new leak-site claim naming your organization.
Query
SigninLogs
| where TimeGenerated > ago(1d)
| where ResultType != "0"
| summarize FailedAttempts = count(), DistinctIPs = dcount(IPAddress) by UserPrincipalName, bin(TimeGenerated, 1h)
| where FailedAttempts > 20 and DistinctIPs > 5
| join kind=inner (
    SigninLogs
    | where TimeGenerated > ago(1d)
    | where ResultType == "0"
    | project UserPrincipalName, SuccessTime = TimeGenerated, IPAddress
) on UserPrincipalName

Hunting queries are starting points for threat hunting & detection engineering — validate table/column names against your own workspace schema and tune thresholds before turning any of these into a production alert rule.