BOOBA is a ransomware operator currently active on public leak sites. Darkfield has indexed 1 public victims claimed by this operator between August 10, 2026. BOOBA is a ransomware group first observed in August 2026 with a primary financial motivation, though due to its extremely recent emergence and limited documented activity, comprehensive public intelligence on this group remains scarce across major threat intelligence sources including CISA, FBI, and Mandiant. Based on available data, the group has claimed or confirmed at least one known victim, with targeting concentrated in the Information Technology sector, suggesting a deliberate focus on technology organizations which may reflect an interest in maximizing leverage through access to sensitive technical data or downstream supply chain exposure. No verified attribution regarding country of origin, RaaS affiliation, or links to established threat actor groups has been publicly documented at this time, and specific details regarding initial access vectors, tooling, encryption methodology, or extortion tactics have not yet been formally reported by reputable security researchers. No notable high-profile campaigns, record ransom demands, or law enforcement actions involving BOOBA have been publicly recorded as of the time of this assessment. Given the group's August 2026 first-observed date and minimal victim count, BOOBA should be considered an emerging or nascent threat actor whose activity profile, capabilities, and operational scope remain largely uncharacterized pending further investigative reporting and intelligence collection.

Recent disclosures by BOOBA

All 1 indexed disclosures. Click any row for the full per-victim dossier.

• IT Services and IT ConsultingInformation Technology · August 10, 2026

See every disclosure indexed for BOOBA →