Buhti Ransomware Operation Repurposes Leaked Encryptors

Red | Vulnerability Report

Buhti ransomware, linked to Blacktail threat actors, employs leaked code of LockBit and Babuk variants. By exploiting vulnerabilities like PaperCut NG, they exfiltrate data and distribute ransomware. The addition of a custom Golang exfiltration tool heightens the evolving threat.

Reduce real exposure. Not just vulnerability volume.