Babuk2 claims responsibility for a breach of the Venezuelan government’s website (www.gob.ve)
The Babuk2 ransomware/extortion group (linked to the actor "Bjorka") published a claim in March 2025 regarding an alleged data breach against the Venezuelan government’s website, identified as www.gob.ve. The claim is listed on public ransomware trackers (ransomware.live and breachsense.com) with a discovery date of March 19–20, 2025; the size of the breach is listed as “unknown,” and no details about the compromised data were disclosed. The VenariX intelligence account noted that the domain www.gob.ve may not actually exist, leaving it unclear which entity was actually affected (possibly Bolivariana de Puertos, Bolipuertos). Security researchers (Rapid7, Halcyon, GuidePoint, Trustwave/SpiderLabs) have generally assessed that Babuk2’s claims are often false or recycled from previous breaches by other groups, with no evidence of new intrusions, so the veracity of the underlying incident is in dispute.
Overview
Missing evidence
Impact details
It has been alleged that Babuk2 caused a security breach at gob.ve with an unknown volume of data leaked, but public security researchers describe Babuk2 as a fake or recycled extortion operation, and no confirmation from the victim, validated data, ransomware execution, or impact on services has been found.
Classification & severity
- Category
- Undetermined
- Subtype
- disputed breach claim
- Confidence
- Low
BreachSense has recorded a report related to Babuk/gob.ve, but information from BankInfoSecurity, Halcyon, and Rapid7 indicates that Babuk2 was based on false, recycled, or baseless extortion claims. Treat this as a disputed case rather than a confirmed data breach.
Severity assessment
Low- Functional impact
- None
- Information impact
- Suspected
- Critical service
- None
- Public confidence
- Limited
The claim targets a domain belonging to the national government, but highly reliable sources indicate that Babuk2 claims are often false or recycled, and no actual compromise by the government has been confirmed.
Timeline
Babuk2 published on its leak site a claim of a breach against the Venezuelan government (www.gob.ve); recorded by the tracker ransomware.live with a discovery date of March 19, 2025.
The VenariX intelligence account documents the claim on X and warns that www.gob.ve may not exist, pointing to a possible connection with Bolivariana de Puertos (Bolipuertos).
Breachsense.com indexes the incident as a data breach involving the Venezuelan government (gob.ve) attributed to Babuk, with an unknown scope of the data leak.
Security investigations (Rapid7, Halcyon, GuidePoint, Trustwave) conclude that Babuk2/Bjorka’s claims are largely false or recycled from previous breaches, casting doubt on the veracity of the incident.