Ransomware Group: BABUK2

VICTIM NAME: mazars[.]fr

NOTE: No files or stolen information are [exfiltrated/downloaded/taken/hosted/seen/reposted/disclosed] by RedPacket Security. Any legal issues relating to the content of the files should be directed at the attackers directly, not RedPacket Security. This blog is simply posting an editorial news post informing that a company has fallen victim to a ransomware attack. RedPacket Security is in no way affiliated or aligned with any ransomware threat actors or groups and will not host infringing content. The information on this page is fully automated and redacted whilst being scraped directly from the BABUK2 Onion Dark Web Tor Blog page.

AI Generated Summary of the Ransomware Leak Page

The ransomware leak page pertaining to Mazars.fr, claimed by the Babuk Locker 2.0 group, provides insights into the data that has been compromised. This particular leak features a variety of sensitive financial information, including monetary amounts in different currencies and associated business names. The document suggested that some data originated from the domain “forvismazars.com”, indicating a potential connection to Forvis Mazars, a known financial audit and consulting firm. The page noted a company revenue of approximately 2.8 billion Euros, underscoring the significant financial implications of the breach.

The page claims a publishable volume of about 1 gigabyte of files, with threats to release up to 1 terabyte of information should negotiations not be pursued. The authors of the post referenced that they have not disclosed confidential information about the company or its clients but acknowledged that the available content contains sensitive details related to financial auditing. Furthermore, the page mentions an image that seems to contain sensitive financial information, although specifics were not disclosed. No download links were found present, but there were references to communication channels for negotiation, highlighting the need for urgent resolution.