Ransomware needs a way in. Stolen credentials are the cheapest one.
Booba Project Ransomware Group
Ransomware group profile
Description
Booba Project is a financially motivated ransomware syndicate that emerged in July 2026. Utilizing a double-extortion business model, the group targets small-to-midsize industrial entities and employs a sophisticated infrastructure for leak disclosures and cryptocurrency ransom demands.
Key insights
- •Leverages stolen credentials from infostealer logs for initial access.
- •Exploits unpatched vulnerabilities in RDP services and legacy software.
- •Neutralizes security mechanisms before executing ransomware payloads.
- •Utilizes hidden onion services for negotiations and data leaks.
- •Stages data exfiltration to cloud servers prior to encryption of hosts.
- •Demands cryptocurrency payments while threatening public exposure of sensitive data.
Threat Level & Status Breakdown
For Booba Project · Based on incidents in selected period
Status Breakdown
Recent activity
Monthly attack count for Booba Project in the selected period
No intelligence data for this group.
TTPs & Attack Vectors
Tools, initial access, and MITRE ATT&CK techniques for Booba Project
T1562
Impair Defenses
T1047
Windows Management Instrumentation
T1486
Data Encrypted for Impact
T1490
Inhibit System Recovery
T1080
Taint Shared Content
T1021
Remote Services
T1021.001
Remote Desktop Protocol
T1041
T1041
T1561
T1561
T1078
Valid Accounts
Victims(23)
| Company | Country | Status | Discovered | |
|---|---|---|---|---|
| upstaging.com | — | Claimed | 2 days ago | |
| URA Group | — | Claimed | 2 days ago | |
| Jani-King | United States | Claimed | 2 days ago | |
| Pelli Clarke & Partners | United States | Claimed | 2 days ago | |
| Telewave.io | — | Claimed | 2 days ago | |
| Altivera | — | Claimed | 2 days ago | |
| frostyacres.com | — | Claimed | 2 days ago | |
| Chernyy and Associates, P.C. | Russia | Claimed | 4 days ago | |
| Davroc Limited | United Kingdom | Claimed | 4 days ago | |
| Country-Wide Insurance Company | United States | Claimed | 4 days ago | |
| Federis Abogados | Mexico | Claimed | 4 days ago | |
| Betz Industries | United States | Claimed | 28 days ago | |
| Oklahoma Manufacturing Alliance | United States | Claimed | about 1 month ago | |
| Incredible Technologies, Inc. | United States | Claimed | about 1 month ago | |
| Zynex AG | Switzerland | Claimed | about 1 month ago | |
| Bob_Saffari_Social_Security_Card.pdf | — | Claimed | about 2 months ago | |
| Edwards_Michael.pdf | — | Claimed | about 2 months ago | |
| BL_License.pdf | — | Claimed | about 2 months ago | |
| canvas.png | — | Claimed | about 2 months ago | |
| Upstaging | United States | Claimed | about 2 months ago |
Page 1 of 2
Affected countries(6)
Countries where this group has been reported to target or leak victims.