Who Is the Network Access Broker ‘Babam’?
Summary: Krebs on Security traced the Russian-language forum handle "Babam," who has sold stolen VPN and Citrix access to ransomware groups since at least 2020, through a February 2016 registration on the hacked forum Verified using operns@gmail.com and a trail of WHOIS records to a Lithuanian named Vytautas Mockus. Flashpoint reported that Babam received at least four positive feedback reviews from actors tied to LockBit, and in April 2021 auctioned Citrix credentials for a company Flashpoint assessed with high confidence was France-based Bureau Veritas, which later shut down its network after a cyber attack.
What you should know: The access behind a ransomware intrusion is often bought, not broken in - and here a single broker's credentials were tied to a victim with more than $5 billion in annual revenue and 78,000 employees.
Read the original at Krebs on Security ↗
- Topics
- Identity & Access Management
- Related
- FBI flash alert says Artex tool automating cyberattacks at ‘machine speed’ Cyber Risks · Nov 13, 2026Connect Wise Cloud Backup application abused in cross-tenant token sweep Cyber Risks · Oct 19, 2026Sponsored: Specter Ops on the impact of AI agents on Blood Hound Cyber Risks · Sep 20, 2026