Fake AnyDesk Sites Are Dropping Babuk Ransomware

Last updated: October 15, 2026

A familiar remote-access tool is being weaponized to distribute Babuk ransomware, and the trick works because the bait looks almost identical to the real thing. Security researchers have documented a campaign in which attackers clone the AnyDesk website and serve a malicious installer that drops ransomware alongside a remote-access trojan onto victims' machines.

The threatening part is not the malware itself—it is the front door. Fake pages rank in search results and mirror the official AnyDesk branding closely enough that even careful users click.

How the infection chain works

The attack uses a layered approach designed for stealth and persistence. When a user clicks the fake download, the payload archive contains a clean AnyDesk installer, an AllaKore RAT client named bthudtaskt.exe, a Babuk downloader named mdnsFULLHD.exe, and a registry file called Anydesk.reg.

The clean AnyDesk app installs visibly on the desktop, which reassures the user that nothing is wrong. In the background, the registry file disables User Account Control by setting EnableLUA to 0, disables Windows Defender by setting DisableAntiSpyware to 1, and turns off real-time protection. The Babuk downloader—roughly 12MB and compiled for Windows—adds Defender exclusion paths to user folders and then disables Task Manager along with other Defender modules.

The AllaKore RAT, an open-source tool written in Delphi, gives attackers ongoing remote access. After establishing persistence, the malware contacts an external server to download an update file (Update.exe) that contains the actual Babuk payload. This file runs vssadmin.exe to delete all Shadow Copy volumes, preventing file recovery. It then encrypts files with a ".doydo" extension and drops a ransom note in every folder. The encrypted files are tagged with the string "Chong Dong looks like a hot dog!!" at the end.

Why it matters

This campaign exposes a troubling shift: the delivery mechanism is now more polished than the malware itself. Cloning a known brand's site and ranking it in search costs almost nothing and casts a wide net, especially against users who do not check URLs habitually.

The payload combination is deliberate. Ransomware generates urgency and extortion use. The RAT ensures attackers retain access even after encryption—allowing credential harvesting, lateral movement, and repeat visits. Organizations that pay the ransom may find attackers still inside.

Who loses:** Small businesses and freelancers without managed IT, plus any team that treats remote-access tool requests as routine.

Who benefits:** Attackers who convert a low-effort phishing page into ransomware payments and persistent network footholds.

Defensive checklist

• Download AnyDesk only from anydesk.com—verify the URL before clicking
• Check the installer's digital signature before running any executable
• Treat any unexpected prompt to install a remote tool as a phishing signal, not a convenience
• Lock down admin rights; require software installs through an approved portal
• Monitor for Defender disablement events—those are a high-fidelity indicator of compromise

What to watch next

Watch for anydesk-themed malvertising expanding to other remote-access brands, and for more campaigns that ship a visible clean app alongside hidden payloads. The pattern—"look legitimate on the surface, break things underneath"—is what every team should be training against.

Key takeaways

• Cloned AnyDesk sites have been pushing a payload that bundles Babuk ransomware with an AllaKore RAT.
• The infection disables User Account Control and Windows Defender before encrypting files with a ".doydo" extension.
• Always download remote-access tools from the official domain and verify the installer's signature.
• The combination of ransomware and RAT gives attackers both extortion use and persistent access.
• Treat sudden prompts to install remote tools as a red flag rather than a routine request.