New Buhti ransomware gang uses leaked Windows, Linux encryptors


Level 15
Thread author
Top Poster
Mar 13, 2022
A new ransomware operation named 'Buhti' uses the leaked code of the LockBit and Babuk ransomware families to target Windows and Linux systems, respectively.

While the threat actors behind Buhti, now tracked as 'Blacktail,' have not developed their own ransomware strain, they have created a custom data exfiltration utility that they use to blackmail victims, a tactic known as "double-extortion."

Buhti was first spotted in the wild in February 2023 by Palo Alto Networks' Unit 42 team, which identified it as a Go-based Linux-targeting ransomware.

A report published today by Symantec's Threat Hunter team shows that Buhti also targets Windows, using a slightly modified LockBit 3.0 variant codenamed "LockBit Black."

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.