Babuk’s primary goal is financial gain through extortion. They achieve this using a "double extortion" tactic. First, they steal sensitive corporate data. Then, they encrypt the victim’s network files. This gives them two points of leverage: demanding a ransom to decrypt the files and another payment to prevent the public release of the stolen data.

To get inside a network, Babuk actors rely on a few classic techniques. They often use phishing emails with malicious attachments or links to gain initial access. They also exploit known vulnerabilities in unpatched software and use brute force attacks to crack weak passwords. Once inside, they use command-line operations to spread across the network and encrypt resources.

Babuk’s malware is designed to be efficient. Before encrypting files, it kills a predefined list of processes and services to avoid being detected by security tools. It uses strong encryption algorithms to lock down files and adds a unique extension. While the original group stated it would avoid targets like hospitals and non-profits, their attacks have hit a range of sectors, including transportation, manufacturing, and even the Washington D.C. Police Department.