THREAT ACTOR
BOOBA-TEAM_
ActiveBOOBA-TEAM is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem: file encryption combined with the threat of stolen-data publication on a public leak site. It continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of BOOBA-TEAM, including incident write-ups, attribution notes and additional context, see the Threat Groups archive or run a site search.
Victims by year
- 2026 67
Leak site mirrors
5 mirrors tracked, 0 currently reachable. These are criminal-infrastructure URLs; links are deliberately not provided.
-
eazk7las3xsvsyxgww3jgzammqjevso2ydnmlopdhl3u2muyrmmilrqd.onionsnapshot · 2026-11-11 01:02 -
7t3zi3e7ki6iseun77ofqtr6wmbpgnpc2ada6gstcxp54lw6q2zb7jad.onionBooba Project snapshot · 2026-11-11 09:01 -
7t3zi3e7ki6iseun77ofqtr6wmbpgnpc2ada6gstcxp54lw6q2zb7jad.onionBooba Project snapshot · 2026-11-11 14:00 -
d77tnb4bkmj3e366msrzllnwsi2t5e54e4yqh7zm7y5hlfwugnwzswad.onionBooba Storage snapshot · 2026-09-14 05:06 -
culappkcuogv2omb37253e236mvmsfzvl4yw3p3incyzeoixhc6ocxqd.onionBooba Storage snapshot · 2026-11-11 13:01
Recent victims
The 50 most recent victims claimed by BOOBA-TEAM. Total in the index: 67.
| Date listed | Victim | Description |
|---|---|---|
| 2026-11-10 | COMPUTER TASK GROUP, Inc. | IT Services and IT Consulting Website: www.ctg.com Stolen data: 50 GB. |
| 2026-11-10 | Georgetown Sleep Center | Medical Practices Website: www.georgetownsleepcenter.com Stolen data: … |
| 2026-11-10 | Collier Sports Medicine and Orthopedic Center | Hospitals and Health Care Website: www.colliersportsmedicine.com Stole… |
| 2026-11-10 | El Portal Imaging Center | Research Services Website: www.elportalimaging.com Stolen data: 1 GB. |
| 2026-11-10 | Day One RI | Non-profit Organizations Website: www.dayoneri.org Stolen data: 30 GB. |
| 2026-11-10 | Acclaim Health | Hospitals and Health Care Website: www.acclaimhealth.ca Stolen data: 5… |
| 2026-11-03 | Boardman Park | Recreational Facilities Website: www.boardmanpark.com Stolen data: 5 G… |
| 2026-11-03 | Vetstoria | Veterinary Services Website: www.vetstoria.com Stolen data: 5 GB. |
| 2026-11-03 | City of Edgewater | Government Administration Website: www.cityofedgewater.org Stolen data… |
| 2026-11-03 | DROUIN SAS | Wood Product Manufacturing Website: www.drouin.fr Stolen data: 20 GB. |
| 2026-10-29 | South Weber City | Government Administration Website: www.southwebercity.gov Stolen data:… |
| 2026-10-29 | Programs for Parents, Inc. | Non-profit Organizations Website: www.programsforparents.org Stolen da… |
| 2026-10-29 | Circleville Police Department | Government Administration Website: www.circlevillepolice.com Stolen da… |
| 2026-10-29 | Terrebonne Parish Government | Government Relations Services Website: www.tpcg.org Stolen data: 105 G… |
| 2026-10-29 | LifeFone | Medical Equipment Manufacturing Website: www.lifefone.com Stolen data:… |
| 2026-10-29 | National Association of Credit Management | Financial Services Website: www.nacm.org Stolen data: 38 GB. |
| 2026-10-29 | California School Boards Association | Education Management Website: www.csba.org Stolen data: 80 GB. |
| 2026-10-27 | Horizon Eye Specialists & LASIK Center | Medical Practices Website: www.horizonlaservision.com Stolen data: 121… |
| 2026-10-27 | Aesthetic Specialty Centre | Medical Practices Website: www.asc-psd.com Stolen data: 22GB. |
| 2026-10-27 | City of Big Spring | Government Administration Website: www.mybigspring.com Stolen data: 15… |
| 2026-10-27 | KING FAMILY MEDICAL | Hospitals and Health Care Website: www.kingfamilymedical.net Stolen da… |
| 2026-10-27 | Charter Township of Commerce | Government Administration Website: www.commercetwp.com Stolen data: 15… |
| 2026-10-27 | RCOA- Regent Christian Online Academy | Hospitals and Health Care Website: www.rcoa.ca Stolen data: 1 GB. |
| 2026-10-27 | Kerckstede vzw | Hospitals and Health Care Website: www.althus.be Stolen data: 10 GB. |
| 2026-10-27 | BASS Medical Group | Medical Practices Website: www.bassmedicalgroup.com Stolen data: 100 G… |
| 2026-10-27 | Hudson River Museum | Museums, Historical Sites, and Zoos Website: www.hrm.org Stolen data: … |
| 2026-10-20 | COASTAL CAROLINA NEUROPSYCHIATRIC CENTER, PA | Medical Practices Website: www.coastalcarolinapsych.com Stolen data: 1… |
| 2026-10-20 | Research Foundation of The City University of New York | Education Administration Programs Website: www.rfcuny.org Stolen data:… |
| 2026-10-20 | Chicago Vein Institute | Medical Practices Website: www.chicagoveininstitute.com Stolen data: 3… |
| 2026-10-20 | Pearland Pediatrics | Hospitals and Health Care Website: www.pearlandpediatrics.com Stolen d… |
| 2026-10-20 | City of Mt. Angel, Oregon | Government Administration Website: www.ci.mt-angel.or.us Stolen data: … |
| 2026-10-20 | City Hall - Everett, MA | Government Administration Website: ci.everett.ma.us Stolen data: 15 GB… |
| 2026-10-04 | MorseLife Health System, Inc. | Hospitals and Health Care Website: www.morselife.org Stolen data: 344 … |
| 2026-10-02 | Raleigh Family Medicine | Hospitals and Health Care Website: www.rfppa.com Stolen data: 1 GB. |
| 2026-10-02 | EdgeEndo® USA | Medical Device Website: www.edgeendo.com Stolen data: 103 GB. |
| 2026-10-02 | Soni Medical Centre | IT Services and IT Consulting Website: www.lakewoodmedical.ca Stolen d… |
| 2026-10-02 | University of Illinois Chicago | Higher Education Website: www.uic.edu Stolen data: 344 GB. |
| 2026-10-01 | FUNAP - Fundação "Prof. Dr. Manoel Pedro Pimentel" | Government Relations Services Website: funap.sp.gov.br Stolen data: 26… |
| 2026-10-01 | ASSOCIATED GASTROENTEROLOGISTS OF CENTRAL NEW YORK, P.C | Medical Practices Website: www.gastrocny.com Stolen data: 70 GB. |
| 2026-09-23 | COSEF - Consorzio di Sviluppo Economico del Friuli | Facilities Services Website: cosef.fvg.it Stolen data: 200 GB. |
| 2026-09-23 | The Merrimack County | Government Administration Website: www.merrimackcounty.net Stolen data… |
| 2026-09-23 | Smart Eye Care | Optometrists Website: www.smarteyecare.com Stolen data: 7 GB. |
| 2026-09-23 | Washington County | Government Administration Website: washingtoncountymaine.com Stolen da… |
| 2026-09-22 | Tulare Western High School | Education Administration Programs Website: www.tjuhsd.org Stolen data:… |
| 2026-09-22 | GOTTHELF | Healthcare Website: www.gotthelfmd.com Stolen data: 2 GB. |
| 2026-09-14 | Mestechkin Law Group P.C. | Law Practice Website: www.lawmlg.com Stolen data: 37 GB. |
| 2026-09-14 | Atlas Ocean Voyages | Travel Arrangements Website: www.atlasoceanvoyages.com Stolen data: 37… |
| 2026-08-24 | Davroc | Furniture and Home Furnishings Manufacturing Website: www.davroc.co.uk… |
| 2026-08-24 | Chernyy & Associates | Law Practice Website: www.chernyy-law.com Stolen data: 67 GB. |
| 2026-08-24 | Country-Wide Insurance | Insurance Website: www.cwico.com Stolen data: 92 GB. |
CONFIRMED ATTACKS
Booba Team confirmed attacks: 2 verified incidents
Ransomnews has verified 2 Booba Team incidents against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. The confirmed record runs from August 2026 to September 2026. United States accounts for 2 of them (100%). The most affected sector is government, at 1 confirmed victim. A ransom payment was publicly confirmed in 0 cases and publicly refused in 1; the outcome is unrecorded in the remaining 1.
Confirmed victims by year
Most affected sectors
Most affected countries
Verified Booba Team incidents
| Date | Organisation | Sector | Location | Records | Ransom paid | Source |
|---|---|---|---|---|---|---|
| September 2026 | BASS Medical Group | Healthcare | California, United States | — | No | Source |
| August 2026 | The City of Mt. Angel | Government | United States | — | Unknown | Source |
Claimed vs confirmed. The figures above the fold on this page come from Booba Team's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design: most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.