RegistroCiberVE
All threat actors
Threat actor

Babuk2 / SkyWave / Bjorka

Babuk2, linked in open-source sources to aliases such as SkyWave and Bjorka, is a digital extortion group that reused the Babuk brand. Researchers have noted that several of Babuk2’s claims appear to be false, recycled, or insufficiently substantiated; it should not be automatically conflated with the original Babuk operation.

Incidents
1
High impact
0
First seen
Mar 19, 2025
Latest seen
Mar 19, 2025

Linked incidents

disputed breach claim

Babuk2 claims responsibility for a breach of the Venezuelan government’s website (www.gob.ve)

The Babuk2 ransomware/extortion group (linked to the actor "Bjorka") published a claim in March 2025 regarding an alleged data breach against the Venezuelan government’s website, identified as www.gob.ve. The claim is listed on public ransomware trackers (ransomware.live and breachsense.com) with a discovery date of March 19–20, 2025; the size of the breach is listed as “unknown,” and no details about the compromised data were disclosed. The VenariX intelligence account noted that the domain www.gob.ve may not actually exist, leaving it unclear which entity was actually affected (possibly Bolivariana de Puertos, Bolipuertos). Security researchers (Rapid7, Halcyon, GuidePoint, Trustwave/SpiderLabs) have generally assessed that Babuk2’s claims are often false or recycled from previous breaches by other groups, with no evidence of new intrusions, so the veracity of the underlying incident is in dispute.

Gobierno de Venezuela (gob.ve)