Crypt Ghouls, LockBit 3.0, and Babuk Ransomware: Threat Analysis and Legal Remedies Under Indian Law

The Rise of Crypt Ghouls and Hybrid Ransomware Threats

Recent threat intelligence reports have highlighted the aggressive campaigns of an advanced persistent threat (APT) group known as Crypt Ghouls. Operating with sophisticated reconnaissance and deployment tactics, the group has targeted enterprises and industrial organizations using leaked and customized versions of infamous ransomware strains, primarily LockBit 3.0 (also known as LockBit Black) and Babuk.

While initial campaigns focused on Russian commercial enterprises, the democratization of leaked ransomware builders means threat actors readily pivot across borders. For Indian enterprises, particularly those situated in commercial and manufacturing hubs like Mumbai, Thane, and the wider Mumbai Metropolitan Region (MMR), the methods deployed by Crypt Ghouls serve as an urgent case study in operational vulnerability, regulatory compliance, and cyber resilience.

In this explainer, APS Law breaks down the anatomy of these attacks, examines the liability and reporting matrix under Indian cyber statutes, and outlines step-by-step reporting avenues for corporate victims.

---

Deconstructing the Attack Vector: LockBit 3.0 and Babuk

Crypt Ghouls does not rely on novel, zero-day malware built from scratch. Instead, it utilizes leaked source codes and builders of tier-one ransomware families, pairing them with robust "Living off the Land" (LotL) techniques:

1. Initial Access: The threat group often gains entry via compromised VPN credentials, unpatched external-facing servers, or targeted spear-phishing.
2. Lateral Movement: Attackers deploy legitimate administrative tools—such as PowerShell, AnyDesk, PsExec, and Mimikatz—to harvest enterprise credentials and navigate internal networks undetected.
3. Data Exfiltration: Before encryption, confidential corporate data is exfiltrated to off-site command-and-control servers, enabling double extortion.
4. Dual-Ransomware Deployment: By alternating between LockBit 3.0 (which encrypts Windows systems rapidly via multi-threaded processes) and Babuk (frequently compiled to target Linux environments and ESXi hypervisors), the attackers paralyze an enterprise’s entire operational stack.

For an Indian organization, such an intrusion causes immediate disruption of operations, reputational harm, and significant legal liability if customer or employee personal data is compromised.

---

Indian Legal Framework Governing Ransomware Attacks

Victims of ransomware in India are not without legal recourse. Cyber extortion and unauthorized data destruction trigger multiple overlapping legal frameworks, spanning special cyber statutes and general criminal law.

1. The Information Technology Act, 2000 (IT Act)

• Section 43 read with Section 66: Imposes civil liability and criminal penalties for unauthorized access, data extraction, damage to computer systems, and introducing computer contaminants (malware).
• Section 66C & 66D: Penalizes identity theft and cheating by personation, frequently triggered when attackers use stolen credentials to access administrative accounts.
• Section 66F (Cyber Terrorism): If a ransomware attack targets critical information infrastructure (CII)—such as power grids, banking backbones, or public health systems—or threatens the sovereignty and economic security of India, the offense can be prosecuted as cyber terrorism, carrying a sentence of up to life imprisonment.

2. The Bharatiya Nyaya Sanhita, 2023 (BNS)

With the replacement of the Indian Penal Code (IPC) by the Bharatiya Nyaya Sanhita (BNS), criminal charges against threat actors and their local co-conspirators are registered under updated provisions:

• Section 308 (Extortion): Ransomware operators demand cryptocurrency in exchange for decryption keys. This constitutes extortion under Section 308 of the BNS.
• Section 324 & 326 (Mischief and Damage to Property): The intentional encryption or deletion of enterprise data constitutes mischief resulting in substantial wrongful loss.
• Section 111 (Organised Crime): Where cyber syndicates carry out systematic unlawful activity for economic gain using coercion, charges relating to organized crime syndicates can be invoked by investigative agencies.

---

Compliance Mandates: CERT-In and Data Protection Laws

When a ransomware incident strikes, enterprise response must not merely be technical; it must also be regulatory.

The CERT-In Six-Hour Mandatory Reporting Rule

Under the cyber security directions issued by the Indian Computer Emergency Response Team (CERT-In) under Section 70B(6) of the IT Act, organizations are legally mandated to report specific cyber security incidents—explicitly including ransomware attacks—within six hours of noticing them. Failure to report carries potential penal consequences under Section 70B(7) of the IT Act.

Digital Personal Data Protection Act, 2023 (DPDP Act)

If the ransomware exfiltrates or compromises personal data belonging to customers, employees, or vendors, the impacted company acts as a Data Fiduciary. Under the DPDP Act, organizations have an obligation to implement reasonable security safeguards and report data breaches to the Data Protection Board of India and affected data principals in the manner prescribed by the forthcoming rules.

---

How Victims in Mumbai, Thane, and Mira Road Can Take Action

When an enterprise based in the Mumbai Metropolitan Region suffers an intrusion, timely coordination with local law enforcement is essential.

Incident Detected -> Isolate Systems -> Preserve Forensic Logs -> Report to CERT-In (Within 6 Hours) -> File Police Complaint / FIR

Step-by-Step Reporting Channels:

1. National Cyber Crime Reporting Portal: Immediately log the incident at cybercrime.gov.in, categorizing it as an enterprise financial/data cyber crime.
2. Mumbai Cyber Police: Depending on corporate jurisdiction, victims can report directly to the specialized Cyber Crime Police Stations:
   • South Region Cyber Cell: Worli.
   • Central Region Cyber Cell: Cyber Police Station, BKC (Bandra Kurla Complex)—the primary hub for corporate and banking cyber investigations.
   • Western/Eastern Suburbs Cyber Cells: Located within suburban commissionerates.
3. Thane & MBVV Commissionerates:
   • For entities located in Thane industrial belts (e.g., Wagle Estate), filings can be made with the Thane Police Cyber Crime Cell.
   • Organizations in Mira Road and Bhayandar fall under the jurisdiction of the Mira-Bhayandar Vasai-Virar (MBVV) Police Commissionerate Cyber Cell.

---

Preserving Electronic Evidence Under the Bharatiya Sakshya Adhiniyam, 2023 (BSA)

A common mistake corporate victims make during remediation is reformatting encrypted drives or wiping servers before evidence is collected. Under the Bharatiya Sakshya Adhiniyam, 2023 (BSA), which governs evidentiary rules in Indian courts:

• Section 61 to 63 of BSA: Lay down the admissibility requirements for electronic records, replacing the erstwhile Section 65B of the Indian Evidence Act.
• Chain of Custody: IT administrators must preserve system logs, ransom notes, network packet captures, and memory dumps without altering hashes.
• Certificate Requirements: A formal certificate under Section 63(4) of the BSA must be prepared by the IT Head or forensic custodian, attesting to the lawful custody and operational integrity of the devices that captured the logs.

Paying a ransom is strongly discouraged by law enforcement agencies, does not guarantee data restoration, and risks violating financial and anti-money laundering regulations.

---

Frequently Asked Questions (FAQs)

1. Is it illegal for an Indian company to pay a ransom to decrypt its data?

While Indian law does not contain an express statutory ban on paying a ransom, doing so is fraught with legal liability. Ransom payments channeled through unregistered crypto exchanges may violate the Prevention of Money Laundering Act (PMLA), the Foreign Exchange Management Act (FEMA), and counter-terrorism financing guidelines if the recipient group is affiliated with sanctioned entities.

2. Can directors be held personally liable for a ransomware attack?

If the enterprise failed to adopt "reasonable security practices and procedures" as mandated under Section 43A of the IT Act (and corresponding rules), or failed to exercise due care under the DPDP Act and the Companies Act, 2013, directors and key managerial personnel may face regulatory inquiries, fines, and civil claims for corporate negligence.

3. What should be our first step after discovering a Babuk or LockBit infection?

Immediately disconnect affected endpoints and servers from the internal network and internet (isolate, do not power off). Preserve all volatile memory where possible, engage your cyber legal counsel and incident response team, and initiate the CERT-In incident notification process within the mandatory six-hour window.

4. What is the role of legal counsel during a ransomware crisis?

Legal counsel assists in managing incident response under legal privilege, advising on ransom negotiation legality, drafting mandatory regulatory filings for CERT-In and sectoral regulators (RBI, SEBI, IRDAI), and interfacing with the Cyber Police to register an FIR under BNS and the IT Act.

---

Legal Advisory and Cyber Incident Response with APS Law

Navigating a sophisticated ransomware incident requires swift legal, technical, and regulatory intervention. APS Law advises startups, commercial firms, and corporate boards across Mumbai, Thane, and Mira Road on cyber law compliance, digital forensics governance, CERT-In response management, and white-collar criminal complaints under the BNS and IT Act.

If your organization has experienced an unauthorized intrusion or requires a proactive cyber legal compliance audit, request a consultation with APS Law to protect your business assets and mitigate regulatory exposure.