A new ransomware operation named 'Buhti' uses the leaked code of the LockBit and Babuk ransomware families to target Windows and Linux systems, respectively.
While the threat actors behind Buhti, now tracked as 'Blacktail,' have not developed their own ransomware strain, they have created a custom data exfiltration utility that they use to blackmail victims, a tactic known as "double-extortion."
Buhti was first spotted in the wild in February 2023 by Palo Alto Networks'
Unit 42 team, which identified it as a Go-based Linux-targeting ransomware.
A report published today by
Symantec's Threat Hunter team shows that Buhti also targets Windows, using a slightly modified LockBit 3.0 variant codenamed "LockBit Black."
