Skip to main content
Darkfield

Operator dossier

Booba Project is a ransomware operator currently active on public leak sites. Darkfield has indexed 6 public victims claimed by this operator between July 6, 2026 and July 7, 2026. Booba Project is a nascent ransomware group first observed in July 2026, operating with an apparent financial motivation based on its targeting patterns, though limited public documentation exists given its recent emergence and small victim footprint. The group has claimed or been attributed to at least four known victims, with activity concentrated in Spain and the United States, spanning sectors including telecommunications, agriculture and food production, and technology, suggesting opportunistic rather than highly targeted sector-specific campaigns. Due to the group's recency and limited victim count, no detailed technical analysis of their tooling, initial access vectors, encryption methodology, or extortion tactics has been publicly documented by CISA, the FBI, Mandiant, or other reputable threat intelligence sources at this time. No notable high-profile campaigns, record ransoms, or law enforcement actions have been publicly attributed to Booba Project as of the available reporting period. Given its first observation date of July 2026 and minimal public reporting, the group should be considered emergent and actively monitored, with its operational status, potential RaaS affiliation, and country of origin remaining unconfirmed pending further intelligence collection and disclosure by authoritative cybersecurity organizations.

Most-targeted sectors

Most-affected countries

Recent disclosures by Booba Project

All 6 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for Booba Project →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Active ransomware operator

← All groups

Booba Project

6 victims indexed · first seen 9 days ago · last activity 8 days ago

6
Victims indexed
#238 of 364 tracked operators
<1m
Active period
Jul 2026 → Jul 2026
2
Countries hit
top ES · 2

At a glance

Status
active
First seen
9 days ago
Last activity
8 days ago
Primary sector
Telecommunication · 1 hits

About

Booba Project is a nascent ransomware group first observed in July 2026, operating with an apparent financial motivation based on its targeting patterns, though limited public documentation exists given its recent emergence and small victim footprint. The group has claimed or been attributed to at least four known victims, with activity concentrated in Spain and the United States, spanning sectors including telecommunications, agriculture and food production, and technology, suggesting opportunistic rather than highly targeted sector-specific campaigns. Due to the group's recency and limited victim count, no detailed technical analysis of their tooling, initial access vectors, encryption methodology, or extortion tactics has been publicly documented by CISA, the FBI, Mandiant, or other reputable threat intelligence sources at this time. No notable high-profile campaigns, record ransoms, or law enforcement actions have been publicly attributed to Booba Project as of the available reporting period. Given its first observation date of July 2026 and minimal public reporting, the group should be considered emergent and actively monitored, with its operational status, potential RaaS affiliation, and country of origin remaining unconfirmed pending further intelligence collection and disclosure by authoritative cybersecurity organizations.

Timeline

1 months
2026-07-01T00:00:00+00:00 · 4
2026-07-01T00:00:00+00:002026-07-01T00:00:00+00:00

Top countries

🇪🇸 Spain
2
🇺🇸 United States
2
Spain dossier →United States dossier →

Top sectors

Telecommunication
1
Agriculture and Food Production
1
Technology
1
Telecommunication dossier →Agriculture and Food Production dossier →Technology dossier →

MITRE ATT&CK

9 techniques · 6 tactics

Tactics

Initial AccessExecutionDiscoveryCollectionExfiltrationImpact

Techniques

  • T1190Exploit Public-Facing Application
  • T1566Phishing
  • T1059Command and Scripting Interpreter
  • T1083File and Directory Discovery
  • T1082System Information Discovery
  • T1005Data from Local System
  • T1041Exfiltration Over C2 Channel
  • T1486Data Encrypted for Impact
  • T1490Inhibit System Recovery

Recent victims

Loading…

Source

Updated 8 days ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time Booba Project posts a victim.

Add Booba Project to your watchlist — Pro pings you within 5 minutes of any new Booba Project leak-site post, Telegram callout, or affiliate-rebrand inference.