Booba Project (also seen as Booba Team) is a ransomware crew running double extortion, which started naming victims on an onion leak portal at the end of June 2026. Victims find a note named booba.txt, signed "The Booba Team", that poses as a decryption service: it says data was copied out before systems were locked, offers a test decryption, and gives an onion chat address with a per-victim authorisation code. Encrypted files carry the .booba extension. The note states no price, deadline or payment method. Listings started with law, architecture, manufacturing and technology firms, mostly in the United States, and from late September 2026 shifted toward hospitals and clinics, county administrations and schools. Windows and Linux encryptors have been reported but no sample has been publicly analysed, and the entry route in known cases has not been disclosed. Several listed organisations have confirmed that files were taken. A security vendor has assessed the group as a likely rebrand of Frag, which went quiet in mid-2025; that link is unconfirmed.
File extensions: .booba
Ransom note filenames: booba.txt
Decryptor: Decryptor availability has not been recorded. Checked 2026-10-28.
Data exfiltration risk: Confirmed — At least one listed organisation has publicly confirmed that data was taken from its servers, and the group posts stolen data to Tor storage servers.
Systems typically targeted: Windows and Linux systems (reported; no sample publicly analysed)
Do this first: Search Windows and Linux servers for booba.txt and .booba files to scope encryption, and do not log in to the chat with the note's authorisation code until counsel decides on engagement.
Dealing with an active incident? Our incident response team is available 24/7.
Emergency response: +1 (877) 364-5161