Leaked Babuk and LockBit Code Fuels SEXi, Key Group, and Mallox Ransomware

Ransomware operators are increasingly building campaigns around leaked, published, purchased, or affiliate-provided malware instead of developing their own tooling, lowering the barrier to entry for new and mid-tier cybercrime groups. Research highlighted SEXi as a group targeting VMware ESXi environments with leaked Babuk code for Linux and leaked LockBit code for Windows, showing how previously exposed ransomware builders continue to enable active attacks across mixed environments.

The same reporting identified Key Group as an operator that has rotated through at least eight ransomware families since 2022 while relying on comparatively unsophisticated infrastructure, and Mallox as an operation that evolved from a private group into an affiliate program with selective recruitment. The findings indicate that leaked ransomware variants remain operationally dangerous even when used by less mature actors, because affiliate models, niche targeting, and access to proven encryptors can still support effective intrusions and larger-scale big game hunting campaigns.