Ransomware Group: BABUK2

VICTIM NAME: marinabaysands[.]com –  Singapore Hotel (Internal Server)

NOTE: No files or stolen information are [exfiltrated/downloaded/taken/hosted/seen/reposted/disclosed] by RedPacket Security. Any legal issues relating to the content of the files should be directed at the attackers directly, not RedPacket Security. This blog is simply posting an editorial news post informing that a company has fallen victim to a ransomware attack. RedPacket Security is in no way affiliated or aligned with any ransomware threat actors or groups and will not host infringing content. The information on this page is fully automated and redacted whilst being scraped directly from the BABUK2 Onion Dark Web Tor Blog page.

AI Generated Summary of the Ransomware Leak Page

The leak page associated with Marina Bay Sands, a prominent integrated entertainment center in Singapore, reveals extensive details about the organization, reflecting its significance within the hospitality industry. The resort boasts 2,561 hotel rooms and a substantial exhibition area of 120,000 m², alongside various high-profile attractions including The Shoppes, the ArtScience Museum, and several renowned restaurants by celebrity chefs. Notably, the resort is crowned by the Sands SkyPark which features an impressive infinity pool, recognized as the largest suspended pool globally. This page indicates that substantial internal information may have been compromised through a data breach, highlighting vulnerabilities within their operational security protocols.

The attackers claim to have exfiltrated approximately 400GB of sensitive data from Marina Bay Sands, including various user-related information such as User IDs, email addresses, and personal profiles. The hackers have stated that they are open to negotiations before making this information public, suggesting potential for dialogue aimed at data recovery or resolution. There is also mention of the infrastructure and investments of the Marina Bay Sands, detailing the financial scope of S$8 billion. However, the leak page does not provide direct download links to the stolen data. Furthermore, it’s important to note that the presence of a singular image on the page might signify screenshots of stolen documents or internal interfaces.