Booba Project

Low-volume operation, rising claimed data volume per victim

The MODERATE rating reflects the group's limited operational history and the absence of novel tradecraft. A rating upgrade is warranted if the legal-sector concentration persists, if victim volume increases materially, or if technical analysis reveals capabilities beyond commodity ransomware behavior. Bracketed markers, e.g. [1], point to the numbered sources in Section 08.

Unclustered and unattributed; origin unknown

Opportunistic across sectors, concentrated on the United States

Targeting across the full victim list remains broad and consistent with opportunistic access. Recent postings are the exception: three of the six victims posted since 24 August are law practices (Mexico, Russia, United States), a concentration well above the roughly 2% legal-sector share across all tracked groups in the same window. [6] Assessment (low confidence): this may reflect deliberate selection of legal targets for their high-value client data, or simply the access available to the group or its suppliers; six postings are too few to distinguish the two. The US concentration (61% of victims) tracks with the general ransomware ecosystem's preference for US-based targets. The inclusion of Russian organizations is atypical for Russian-speaking ransomware groups, which frequently avoid domestic targets. This may indicate a non-Russian-speaking operator, a group that does not follow CIS exclusion norms, or a deliberate attempt to obscure origin. [1]

Supply-chain note: One victim is a US public-safety communications equipment vendor that reportedly serves emergency-services and public-safety clients. [6] A compromise of this type of supplier creates downstream risk for the Communications critical-infrastructure sector through potential exposure of customer data, product specifications, or procurement records.

Double extortion with commodity access vectors

Technique mappings below are drawn from threat intelligence aggregators tracking Booba Project's leak-site activity and incident reporting. No first-party malware analysis has been published for this group as of 24 September 2026; techniques represent observed or inferred behavior rather than confirmed reverse-engineering results.

Infostealer correlation: 50% of the first 16 victim organizations (per ransomware.live as of 04 September) had domains linked to infostealer-harvested credential data, suggesting that stolen credentials (purchased from initial access brokers or harvested directly) are a probable entry vector. [1] Attack vectors reported more broadly include phishing, RDP exploitation, and spam email campaigns, though none have been confirmed through published forensic analysis of a Booba Project intrusion. [4]

Three months of operations, 18 victims, ~496 GB of claimed data theft

Posting waves: 06 to 07 July, six postings (five on 06 July), about 86 GB claimed; 15 to 31 July, six postings, about 100 GB; 24 August, four postings in one batch, 235 GB; 14 September, two postings after a three-week pause, 74 GB. [1][6]

Victim data above is aggregated from leak-site monitoring by ransomware.live [1] and Intruvent collection [6]. Per Intruvent public-reporting policy, individual victim organizations are not named. Data volumes represent the group's own claims and have not been independently verified. The average delay between estimated attack date and public discovery was 10.2 days across the first 16 victims. [1] The August 24 batch (four victims posted simultaneously) may indicate queued disclosures rather than four same-day compromises. The two September 14 postings followed a three-week pause, so earlier assessments of a July-only burst no longer hold.

Focus on pre-encryption behaviors; IOC surface is minimal

Eight actions prioritized for double-extortion defense

Bracketed markers in the body point to the numbered sources below. Sources [1] through [5] accessed 04 SEP 2026; source [6] refreshed 24 SEP 2026. Five sources that named individual victims were removed in v1.1.1.