Booba Project is a double-extortion group that began posting victims in mid-2026 and has accelerated sharply since late October. Public detail on its tooling is thin. This profile separates what vendors have documented from what is still unknown. Every victim figure below is a claim from the group’s leak-site listings, not a confirmed breach.
Who they are
The group also appears as “Booba Team” and “booba_project”. Provendata’s profile gives its first leak-site activity as late June 2026 (Provendata). Intruvent’s profile (version 1.1.1) places the earliest estimated attack at 24 June 2026, first external tracking on 26 June, and the first victims on the leak site on 6 July 2026 (Intruvent).
Attribution is unresolved. Provendata reports that two unnamed vendors have described the group as a likely rebrand of Frag, which stopped posting in June 2025, but notes that one of those assessments cites leak-site style and negotiation flow and the other cites no evidence. Intruvent lists attribution as none, at low confidence. We treat any Frag link as unproven. Neither source found affiliate recruitment or evidence of a RaaS model.
Victim claims
Counts differ because each source uses a different window and method.
| Source | Count | As of | Notes |
|---|---|---|---|
| Provendata | 54 claimed victims | 2 Nov 2026 | 23 in the prior 30 days |
| Brandefense | 47 unique victims (53 raw names) | 3 Nov 2026 | Relay data from 1 Aug onward |
| Intruvent | 18 claimed victims | 21 Sep 2026 | About 496 GB claimed by the group |
The pace changed in autumn. Intruvent counted 18 claims by 21 September. Brandefense’s Telegram-relay data shows 6 first relays in August, 8 in September, 29 in October and 4 in the first days of November, with batches of 6 on 20 October, 9 on 27 October, 7 on 29 October and 4 on 3 November (Brandefense).
Sector shift
Early listings leaned toward professional services, including three law practices, and IT services (Intruvent). WatchGuard’s tracker page lists a single victim dated 24 June 2026, earlier than Intruvent’s 6 July first-listing date, so first-victim dates differ by source. Provendata reports that after 22 September listings moved toward healthcare, county governments and schools, with healthcare at 28%, government and defense at 19% and education at 15% of its 54. Brandefense groups its 47 as healthcare 15, government and public bodies 12, other business and non-profit 12, education 5 and law firms 3. It reports the government share rising from 14% (3 of 21) before 20 October to 31% (8 of 26) after.
Named public bodies in Brandefense’s list include Merrimack County, Washington County, Terrebonne Parish Government and the City of Edgewater. These are listings only. Brandefense saw no statement from Edgewater and no sample data on its listing. Provendata says five listed organisations have acknowledged incidents, but none named Booba Project (consistent with its separate report that two victims confirmed data theft without naming the group), and that two listed victims had earlier been claimed by other groups.
Country labels are unreliable. Brandefense says only 32 of 47 entries carry one, with 25 in the United States.
Tradecraft: mostly unknown
Documented by Provendata:
- Encrypted files reportedly use the
.boobaextension and the note isbooba.txt. - The note presents the group as a “data decryption service”, warns that independent recovery attempts “may result in their damage”, and gives no amount, deadline or payment method.
- Windows and Linux variants are reported but have not been analysed. We found no public sample analysis and no public decryptor in the sources checked (Provendata, Intruvent, Derp.ca, Brandefense) as of 5 November 2026; we did not search decryptor repositories.
- The group runs a leak site, a negotiation chat and data-storage servers on Tor.
- Data theft before encryption was confirmed by two victims, but the exfiltration tools are unknown.
Initial access is unconfirmed. Provendata relays an unnamed researcher citing exposed RDP, phishing and, in one case, fileless PowerShell, but no victim has confirmed a route. Intruvent found infostealer-linked data for about half of the first 16 victims’ domains. Provendata notes this does not show the credentials were used for entry.
Indicators
Published indicators are sparse. Provendata lists the contact addresses boobaproject[@]proton[.]me and boobateam[@]proton[.]me; Derp.ca lists only the first. Intruvent lists no email address. The .booba extension comes from Provendata alone. The booba.txt filename appears in both Provendata and Intruvent, and only Provendata quotes the note text; Derp.ca and Intruvent do not mention an extension. Provendata also describes Tor leak, chat and storage services. Provendata and Intruvent report no published file hashes or C2 addresses as of late September and October 2026 respectively. We have not reproduced the onion addresses; defenders should take them from the original profiles for monitoring only.
What defenders should do
Our assessment is that the pattern of municipal and healthcare listings makes this group relevant to public-sector IT teams, but the data does not show how it gets in. Reasonable steps:
- Search endpoints for
.boobafiles andbooba.txt. - Review exposed RDP and VPN services and enforce MFA on remote access, email and admin accounts.
- Check whether staff credentials for your domains appear in infostealer datasets and reset affected accounts.
- Keep offline backups and test restores.
- Prepare a notification plan with counsel before any contact with the group.
Open questions
Whether the group is a rebrand, how it gains access, whether stolen data is deleted after payment, and whether the Linux and Windows variants differ remain unanswered in the sources we reviewed.
References
Access date for all links: 5 November 2026. The Intruvent profile is version 1.1.1.