Loading threat actor…
Booba Project is a financially motivated ransomware and extortion operation that maintains a data-leak site, lists alleged victims, and threatens to publish purportedly stolen information unless ransom demands are met. Its reported targeting is concentrated in the United States, with additional targets in Canada, Brazil, and Italy. Frequently targeted organizations include medical practices, healthcare systems, medical-device businesses, municipal and county governments, universities, and research organizations. Other reported targets include facilities-services organizations and manufacturing-support organizations. The operation's public extortion activity emphasizes claims of data theft. Named targets include the Oklahoma Manufacturing Alliance and the University of Illinois Chicago. Both organizations experienced ransomware incidents, but their appearance on Booba Project's leak site does not independently establish the group's responsibility or substantiate its claimed stolen-data volumes. The Oklahoma Manufacturing Alliance reported finding no evidence of information theft, whereas the University of Illinois Chicago confirmed information theft without attributing its incident to Booba Project. No specific initial-access method, exploited vulnerability, ransomware family, affiliate structure, or country of origin has been established.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
5 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.