Ransomware needs a way in. Stolen credentials are the cheapest one.
booba project Ransomware Group
Ransomware group profile
Description
Booba Project is a financially motivated ransomware syndicate that emerged in July 2026. Utilizing a double-extortion business model, the group targets small-to-midsize industrial entities and employs a sophisticated infrastructure for leak disclosures and cryptocurrency ransom demands.
Key insights
- •Leverages stolen credentials from infostealer logs for initial access.
- •Exploits unpatched vulnerabilities in RDP services and legacy software.
- •Neutralizes security mechanisms before executing ransomware payloads.
- •Utilizes hidden onion services for negotiations and data leaks.
- •Stages data exfiltration to cloud servers prior to encryption of hosts.
- •Demands cryptocurrency payments while threatening public exposure of sensitive data.
Threat Level & Status Breakdown
For booba project · Based on incidents in selected period
Status Breakdown
Recent activity
Monthly attack count for booba project in the selected period
No intelligence data for this group.
TTPs & Attack Vectors
Tools, initial access, and MITRE ATT&CK techniques for booba project
T1562
Impair Defenses
T1047
Windows Management Instrumentation
T1486
Data Encrypted for Impact
T1490
Inhibit System Recovery
T1080
Taint Shared Content
T1021
Remote Services
T1021.001
Remote Desktop Protocol
T1041
T1041
T1561
T1561
T1078
Valid Accounts
Victims(41)
| Company | Country | Status | Discovered | |
|---|---|---|---|---|
| University of Illinois Chicago | United States | Claimed | 7 days ago | |
| MorseLife | United States | Claimed | 5 days ago | |
| Lakewood Medical Centre | Canada | Claimed | 7 days ago | |
| EdgeEndo® USA | United States | Claimed | 7 days ago | |
| Raleigh Family Practice | United States | Claimed | 7 days ago | |
| Telewave, Inc. | — | Claimed | 7 days ago | |
| URA Group | — | Claimed | about 1 month ago | |
| Nfinite 9000 S.L. | — | Claimed | 7 days ago | |
| Fonsan | — | Claimed | 7 days ago | |
| Frosty Acres Brands | United States | Claimed | 3 months ago | |
| Upstaging | United States | Claimed | 3 months ago | |
| Associated Gastroenterologists of CNY, PC | United States | Claimed | 8 days ago | |
| FUNAP - Fundação "Prof. Dr. Manoel Pedro Pimentel" | Brazil | Claimed | 8 days ago | |
| Washington County Maine | United States | Claimed | 16 days ago | |
| Smart Eye Care | United States | Claimed | 16 days ago | |
| The Merrimack County | United States | Claimed | 16 days ago | |
| COSEF - Consorzio di Sviluppo Economico del Friuli | Italy | Claimed | 16 days ago | |
| GOTTHELF | Moldova | Claimed | 17 days ago | |
| Tulare Western High School | United States | Claimed | 17 days ago | |
| Mestechkin Law Group P.C. | United States | Claimed | 25 days ago |
Page 1 of 3
Affected countries(9)
Countries where this group has been reported to target or leak victims.