Booba Project Ransomware: Profile, IOCs, and Incident Response

Booba Project is a double-extortion group: it steals data before encrypting systems with Booba ransomware, then publishes the names and data of organizations that do not engage with it. It began posting victims to its Tor leak site in late June 2026.

This article is a standalone reference for incident response teams, MSPs, and security decision-makers. If you suspect Booba Project activity in your environment, bring in an incident response team before wiping or restoring affected systems, because the evidence on them shows the scope of the intrusion and data theft.

Booba Project ransomware at a glance

What is Booba Project ransomware?

Booba Project is a ransomware group also known as Booba Team: it signs its ransom note as "The Booba Team." The group's structure is not publicly established. No affiliate recruitment posts, forum presence, or Telegram channels tied to the group have been found, and there is no evidence that it runs as ransomware-as-a-service. MITRE ATT&CK does not track the group, and public malware catalogs have no entry for its encryptor.

Is Booba Project a rebrand of Frag?

A Frag connection is a low-confidence hypothesis, not an established lineage. Researchers at two security vendors have described Booba Project as a likely rebrand of Frag, a ransomware operation that stopped posting to its leak site in June 2025.

Neither assessment rests on a public comparison of the encryptors: one points to the leak site's style and negotiation flow, the other cites no evidence. Archived copies show that the two leak sites used the same web template, but such templates are easy to reuse, and the two groups' messaging differs.

Who Booba Project targets

Most organizations on Booba Project's leak site are in the United States, with fewer in Europe, Canada, and Brazil. Through mid-September, listings spanned professional services firms, including three law firms and an architecture practice, along with manufacturers, technology and entertainment companies, and an insurer.

That mix shifted in late September. From September 22 onward, the group posted mostly healthcare providers, county governments, and schools, including a public university. Nothing on the leak site suggests the group excludes hospitals or other critical services.

Publicly acknowledged incidents

Five organizations that have appeared on the leak site have publicly acknowledged a security incident. None of them has been named Booba Project; the link comes from the group's own leak site.

• Upstaging, Inc.: the company noticed unusual network activity around June 2, 2026, and said an unauthorized party may have copied information between May 28 and June 2.
• Pelli Clarke & Partners: the architecture firm says it was notified of suspicious network activity around July 3, 2026, and learned on July 30 that files had been taken.
• Oklahoma Manufacturing Alliance: the organization says ransomware activity hit two employee computers on July 15, 2026, and that it found no evidence that data was removed. The group says it took 10 GB of data. Neither account has been independently verified.
• Merrimack County, New Hampshire: a cyberattack that began in late August 2026 disrupted dispatchers' access to criminal databases and moved the Register of Deeds to paper filings. In October, the county said the attack involved ransomware and that it restored its systems from backups without paying a ransom. It has not confirmed any data theft.
• University of Illinois Chicago (UIC), College of Medicine: the university reported a ransomware attack that temporarily made some of the college's systems unavailable and said the attackers obtained some data from the college's servers. Systems have been restored, and the main UIC network and patient care at UI Health were not affected. As of early October, investigators were still determining whether that data includes personal, research, or academic information.

The remaining listings had not been publicly acknowledged at the time of writing. Two of them, Atlas Ocean Voyages and Incredible Technologies, had previously been claimed by other extortion groups, Insomnia in early 2026 and Dunghill in 2023, which may point to reused data or separate intrusions.

Disclaimer: Victim listings on ransomware leak sites represent unverified claims made by the threat actor. Treat them as unconfirmed unless company disclosures, SEC filings, regulatory notifications, or law enforcement confirm them.

How a Booba Project attack unfolds

No public investigation has reconstructed a Booba Project intrusion from first access to encryption. The table below separates what victim disclosures and leak-site data show from the stages that remain undocumented, listing ATT&CK techniques only where evidence supports them.

Some threat intelligence profiles list more ATT&CK techniques for the group; one includes RDP-based lateral movement, WMI execution, and inhibiting system recovery, which covers deleting shadow copies and backups. These lists differ from one profile to another, and none is based on a documented intrusion, so the table leaves them out. No victim disclosure or malware analysis shows how the group evades EDR or whether it deletes shadow copies.

A security researcher has reported exposed RDP and phishing as entry routes and, in at least one case, fileless execution through an interactive PowerShell session on a host with no EDR agent. The report does not say how this was observed, and no victim disclosure confirms it, so it is not treated as established.

According to ransomware.live, infostealer records include the domains of nearly half of listed victims, but Hudson Rock's data shows employee credentials at only two of them. Breachsense, without saying where its data comes from, counts eight listed organizations with employee credentials leaked in the year before the group posted them. None of it shows the credentials were used to get in. With the entry route unconfirmed, the question is how far back an investigation needs to look.

Magdy Abdelaziz, Proven Data's Head of DFIR, explains: "In many cases, the ransomware operator is not the original intruder. Someone else obtained credentials, VPN access, RDP access, web-shell access, or remote-management access earlier and sold or transferred it. In the logs, we may see first access weeks or months before detonation, though in faster criminal ecosystems the handoff can also be same-day."

Extortion model and leak site

Booba Project has used four Tor services for its extortion: a leak site titled "Booba Project," a negotiation chat called "Booba Chat," and two storage servers labeled "Booba Storage" that have hosted stolen data. No negotiation transcripts or payments tied to the group have been published.

The note, booba.txt, presents the group as a service provider rather than an extortion crew:

Dear Valued Partners,

We represent the Booba team, specializing in data decryption services. As part of our interaction, we have successfully extracted data from your network prior to system lockdown. We guarantee that, in accordance with our agreement, you will receive a functional decryption tool and have the opportunity to test it before making payment.

To familiarize yourself with our work, we invite you to visit our blog where we publish the list of "Silence Keepers": 7t3zi3e7[...]2zb7jad[.]onion

Instructions for Contact:

1. Install the TOR browser at torproject.org/download/ to access our chat.
2. Copy this link - eazk7las[...]mmilrqd[.]onion.
3. Use authorization code - ************ - to log into our chat.

Note: Any independent attempts to recover files may result in their damage, rendering further assistance impossible. We suggest resolving this matter professionally and confidently finding an optimal solution.

Best Regards,The Booba Team

The note claims both data theft and encryption, promises a working decryptor, but says nothing about deleting the stolen data. It names no ransom amount, deadline, or payment method.

Each leak-site post names the organization and the claimed volume of stolen data; some early ones included a sample file. In the four acknowledged incidents where the detection and listing dates are known, the organization appeared on the leak site about two to five weeks after detecting the intrusion. Since late September, links to the stolen data have usually appeared within one to two days of a post.

The leak site is not a fixed record. In early October, the group's post about UIC disappeared, and a post about another victim took its place with the same timestamp and the same claimed data volume. A removed post does not show that the data was deleted, and a post's date and data volume are not reliable evidence on their own.

Indicators of compromise

Public indicators for Booba Project come from the ransom note, the group's Tor infrastructure, and a report of the encrypted file extension.

No file hashes, command-and-control addresses, or YARA rules for the encryptor have been published as of October 2026. Until a sample is analyzed, the only publicly documented signs on an infected host are the ransom note and the reported extension, and both appear only after encryption has started.

What to do if Booba Project is active

Start an emergency incident response with Proven Data's team first, then work through the steps below with the responders.

Communicate and coordinate

1. Coordinate the response by phone or another channel outside corporate email and chat, which may be compromised.
2. Keep one timestamped record of what you found, what you did, and who made each decision. Responders, insurers, and regulators may need it.
3. Do not open the negotiation chat or reply to the group until legal counsel and the response team have decided whether to engage.

Contain the attack

1. In one coordinated step, isolate ransomware-infected servers and other affected systems from the network, wall off backup systems and domain controllers from affected segments, cut VPN and other remote access, and disable accounts the attacker is known to use. Doing it all at once reduces the attacker's time to react.
2. Disconnect systems rather than powering them off: a shutdown erases evidence held in memory. Power a system down only if you cannot disconnect it.
3. Before counting on backups, snapshots, or shadow copies, confirm they survived: it is not publicly known whether Booba Project deletes shadow copies, and most ransomware actors try to delete or encrypt the backups they can reach.

Identify the variant and report the incident

1. Look for booba.txt ransom notes signed "The Booba Team" and files renamed with the reported .booba extension. Check Linux servers as well as Windows systems: a Linux variant has been reported, but neither marker has been tied to it specifically.
2. Report the incident: in the US, to the FBI through IC3 or a local field office, and to CISA; elsewhere, to your national cybersecurity agency. Ask whether a decryptor is available for this group.
3. Notify your cyber insurance carrier and have legal counsel assess notification obligations. Data theft can make the incident a reportable data breach, and under HIPAA, encryption alone can do the same for health data. Later decryption, or the absence of a leak-site post, does not cancel those obligations.

Preserve evidence and scope the data theft

1. Before wiping or restoring anything, preserve ransomware evidence: memory captures and system images from a sample of affected hosts, any encryptor files found, the ransom note, and VPN, identity, firewall, and proxy logs that may roll over.
2. Assume the data has already left the network. Use egress, proxy, and file-access logs to establish what the group took. The answer shows whom to notify and what to expect on the leak site.
3. Review VPN, remote desktop, and identity logs from weeks or months before the encryption date: the first intrusion may predate the ransomware.

Remove attacker access

1. Hunt for persistence while systems are still isolated: new or newly privileged accounts, unexpected remote monitoring and management (RMM) tools, and unusual VPN logins.
2. After removing persistence and rebuilding systems, reset credentials and revoke sessions, starting with privileged accounts and any accounts exposed in infostealer logs.

Can files encrypted by Booba Project be recovered?

No public decryptor exists for Booba Project. The encryptor has not been publicly analyzed, so it is unknown whether its encryption has any weakness that could allow recovery without paying.

The ransom note warns that independent recovery attempts may damage the files. Whatever its purpose, the warning has a technical basis: renaming or modifying encrypted files can cause later decryption to fail, and the note may contain identifiers a decryptor needs. Work only on copies, and keep the originals and the ransom note untouched: if a decryptor or weakness emerges later, it will most likely work on unaltered data.

Without a decryptor, recovery runs through two paths:

• Restore from offline or immutable backups, or from storage snapshots and replicas that the attackers did not reach, once the environment is clean. Before reconnecting restored systems, check that attacker tools did not come back with the data.
• Have a sample of the encryptor from the affected environment analyzed. This is the most direct way to learn whether its encryption can be broken, and ransomware recovery specialists can also assess what can be salvaged from the affected files.

DO NOT PAY THE RANSOM. Decisions about ransom payment carry legal, operational, and financial consequences, including potential OFAC sanctions exposure, and should be assessed with qualified legal counsel and an incident response team before any decision to engage with or pay the threat actor. That assessment must not delay containment, evidence preservation, required reporting, or recovery.

Security checklist

Each control below responds to a known fact about Booba Project or to a gap in what is known.

• Monitor infostealer logs for corporate credentials. With the group's entry route unknown, exposed credentials are an easy door to close: check your own domain, reset any exposed accounts, and revoke their active sessions, since stolen session cookies can bypass MFA.
• Enforce phishing-resistant MFA on all remote access. The group has been reported to use phishing as an entry route, though no victim has confirmed it. Unlike codes and push prompts, this MFA cannot be relayed through a phishing page or approved by a tired user, so neither a stolen password nor a phished code opens a session on email, VPN, or other remote services.
• Take RDP off the internet. Exposed RDP is the other entry route reported for the group, also unconfirmed by any victim; allow remote desktop only through a VPN or gateway that requires phishing-resistant MFA.
• Alert on anomalous logins to VPN and other remote access. If the group enters with stolen credentials, a suspicious login may be the earliest trace it leaves before it takes any data.
• Alert on unusually large outbound transfers. Data leaves the network before encryption, so exfiltration is a chance to stop the attack before files are locked.
• Extend EDR and centralized logging to Linux servers. A Linux variant has been reported, and if EDR and log collection cover only Windows, attacks on Linux servers go unseen.
• Keep offline, encrypted backups and test restores. Without a decryptor, backups are the most reliable way back.
• Retain logs from critical systems for at least a year. The first intrusion can predate encryption by weeks or months, and short retention erases that record.