mtgazeta.uz Listed by babuk2 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On January 27, 2025, the Uzbekistan-based site mtgazeta.uz was listed by the ransomware group known as babuk2. Public reporting indicates that internal files were exfiltrated as part of a ransomware attack. The number of people affected remains unknown, and many operational details of the incident have not been disclosed.

A listing on a ransomware leak site is a claim by the group rather than independent confirmation of every detail. Still, the appearance of a media organization on such a list raises clear concerns for anyone whose information may have been stored in the affected systems, and for the continuity of the outlet’s work.

What happened

According to available public records, mtgazeta.uz was listed by babuk2 on or around January 27, 2025. The reported summary states that internal files were exfiltrated in a ransomware attack. No figure has been given for the volume of data taken, no specific file names or categories beyond “internal files” have been released in the facts, and the number of people affected is listed as unknown.

Timing of the initial intrusion, the exact method of access, whether encryption was also deployed, and any ransom demand or negotiation status are all undisclosed in the public record provided. The listing itself constitutes the group’s claim that it holds data belonging to the organization; independent verification of the full scope has not been detailed in the available facts.

The group behind it: babuk2

Babuk2 is associated with the broader Babuk ransomware family, a group that has operated in the ransomware ecosystem for several years. Publicly documented activity of the Babuk lineage typically involves double-extortion tactics: operators gain access to a network, exfiltrate data, and then threaten to publish or sell that data if a ransom is not paid. Victims are frequently named on dedicated leak sites to increase pressure.

The group has historically targeted a range of sectors rather than specializing in one industry. Its operators have been observed using common initial-access techniques such as compromised credentials or unpatched remote services, followed by lateral movement and data staging before encryption or pure exfiltration. Claims made on leak sites, including the listing of mtgazeta.uz, should be treated as assertions by the threat actor until corroborated by the victim or independent forensic reporting. No specific statements attributed to babuk2 about the contents of this particular breach beyond the listing itself appear in the facts.

Who is mtgazeta.uz?

mtgazeta.uz is an online publication operating under the .uz country-code domain, indicating a presence in Uzbekistan. Organizations of this type typically function as news or media outlets, producing journalism, hosting editorial content, and maintaining internal systems for staff, contributors, subscribers, and advertising partners.

A media organization commonly holds a mix of operational data: employee records, source communications, unpublished material, subscriber or reader contact lists, financial and advertising information, and technical infrastructure details. Because such outlets often serve as information hubs for the public, a compromise can affect both the people whose data is stored and the reliability of the information the outlet provides. The precise nature of mtgazeta.uz’s holdings in this incident has not been itemized beyond the general description of internal files.

What data was at risk

The facts state that internal files were exfiltrated in a ransomware attack. No further breakdown of file types, databases, or personal-data categories has been disclosed. The number of individuals whose information may be included is unknown.

Organizations in the media sector typically retain employee personal details, internal correspondence, source-related notes, financial records, and technical configuration data. Whether any of those categories were among the files allegedly taken from mtgazeta.uz remains unconfirmed. Readers should therefore treat the exact contents as undisclosed rather than assume any particular dataset was or was not involved.

Why it matters

When internal files leave an organization’s control, the practical risks are concrete. Individuals whose contact details, identification numbers, or private communications appear in those files may face phishing, social-engineering attempts, or identity misuse. Journalists and sources can be exposed to pressure or retaliation if unpublished material or confidential exchanges are released. The organization itself may confront operational disruption, loss of trust among readers and partners, and the cost of investigation and remediation.

Because the scale of the exfiltration and the precise data types remain unknown, the full extent of these risks cannot yet be quantified. That uncertainty itself is a reason for caution: people connected to the outlet—staff, freelancers, subscribers, or sources—cannot rule out exposure until more information becomes available or until they check whether their own details have appeared in known breach corpora.

What to do if you're exposed

If you have a relationship with mtgazeta.uz—as an employee, contributor, subscriber, or source—consider the following practical steps:

• Change passwords for any accounts that may have been used with the organization, and enable multi-factor authentication wherever it is offered.
• Monitor financial and email accounts for unexpected activity or targeted phishing that references the outlet or recent news.
• Be cautious of unsolicited messages that claim to come from mtgazeta.uz staff or that demand urgent action related to a data incident.
• If you handle sensitive source material, review whether any of that material could have been stored on systems belonging to the organization and take appropriate protective measures.
• Run a free exposure scan of your email address against known breach data sets to see whether your information has already surfaced in public or semi-public collections.

Public detail on this incident remains limited. Further official statements from the organization or independent analysis may clarify the scope. Until then, measured personal vigilance is the most reliable immediate response.

AICompiled with AI assistance from public sources and published under our editorial standards.