Classification: TLP:CLEAR | Publication Date: 2026-10-28 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

BOOBA PROJECT Ransomware: 10 New Leak-Site Claims — Healthcare, Education & Municipal Targeting Analysis

Executive Summary

On 2026-10-27, the BOOBA PROJECT ransomware operation listed ten organizations on its dark web leak site in a single coordinated posting wave — an unusually dense 24-hour batch that suggests either a completed intrusion pipeline or a deliberate attention-grabbing dump. The claims span four sectors (Healthcare, Education, Government & Defense, Other) and four countries (US, BE, CA, PK), with a heavy concentration in US healthcare providers and US municipal government entities.

Every listing in this dataset is a single-source, unverified claim by a criminal actor. None of the ten listings were independently observed by a second leak-site crawler, and no tier of this data confirms that any breach occurred. This briefing treats the postings as threat-actor claims only, and uses the claimed victimology to inform sector-level defensive posture.

Organizations in healthcare, education, and municipal government — particularly small-to-midsize US entities — should treat this as a prompt to verify exposure of the attack surfaces BOOBA PROJECT is known to probe: VPN concentrators, RDP, and internet-facing management infrastructure.

Sourcing & Verification

• Corroboration status: 0 of 10 listings were independently observed by a second leak-site crawler. All 10 listings appear on a single source (ransomware.live) only. Single-source status means no second crawler has confirmed the posting even exists on the gang's site.
• What a listing means: Inclusion on a leak site reflects the threat actor's claim. It is not confirmation of a breach. Only the named organization or its regulator can confirm an incident.
• Disputes and denials: A named organization may dispute a listing. A denial is likewise not proof the claim is false — disclosure obligations vary by jurisdiction and sector, and not every incident is reportable. Neither silence nor denial settles the question.
• Corrections: Security Arsenal will publish corrections as warranted and welcomes contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — BOOBA PROJECT

Aliases: BOOBA PROJECT is tracked under its leak-site branding; no widely adopted industry aliases are confirmed at this time. Analysts should monitor for overlap with mid-tier RaaS affiliate branding, as newer operations frequently rebrand from predecessor crews.

Operating model: BOOBA PROJECT's posting cadence — small, burst-style batches of victims across mixed sectors and geographies — is consistent with a RaaS-affiliate model or a lean closed group buying initial access from brokers rather than running a large in-house intrusion team. The diversity of victim geographies (US, BE, CA, PK) in a single day points to access-driven opportunism rather than deliberate sector campaigns.

Ransom demands: Consistent with the SMB/mid-market victim profile observed, demands in this tier of operation typically range from the low six figures to low seven figures USD, calibrated to victim revenue and cyber-insurance posture. Municipal and healthcare victims frequently face pressure via threats to publish PII/PHI.

Initial access methods (sector-level assessment, not tied to any specific named victim):

• Exploitation of internet-facing edge devices and remote access (VPN concentrators, RDP exposed to the internet, firewall management interfaces)
• Credential-based access via phishing, including macro-bearing attachments and credential-harvesting lures
• Access purchased from initial access brokers (IABs) — the likely explanation for the cross-sector, cross-geography victim spread

Extortion model: Double extortion — data theft prior to encryption, with leak-site publication used as leverage. The 10-victim same-day posting pattern suggests data was staged and exfiltrated before victims were publicly named.

Dwell time: Mid-tier operations in this class typically dwell days to a few weeks between access and detonation; the pre-encryption window is where defenders have the best chance of interdiction.

Current Campaign Analysis

Sectors Targeted (per leak-site claims)

The 10 organizations BOOBA PROJECT has listed break down as follows:

• Healthcare (4): Horizon Eye Specialists & LASIK Center (US), BASS Medical Group (US), KING FAMILY MEDICAL (US), Aesthetic Specialty Centre (PK)
• Education (3): Hudson River Museum (US), RCOA- Regent Christian Online Academy (CA), Regent Christian Online Academy (CA)
• Government & Defense (2): Charter Township of Commerce (US), City of Big Spring (US)
• Other (1): Kerckstede vzw (BE)

Note the near-duplicate Canadian listings (RCOA / Regent Christian Online Academy) — likely the same organization posted twice under variant names, a common sign of sloppy affiliate bookkeeping rather than two distinct incidents. Adjusted effective victim count: 9 unique organizations.

Geographic Concentration

US-centric (6 of 10 listings), with single listings in Belgium, Canada (2, likely one org), and Pakistan. This is consistent with English-language affiliate operations that buy access wherever brokers supply it, with a preference for US victims due to insurance-driven payout propensity.

Victim Profile

The claimed victims skew toward small-to-midsize organizations: specialty medical practices, a museum, an online school, a township, and a small city. Revenue estimates for this profile generally fall in the $1M–$100M range — organizations large enough to carry insurance and hold regulated data (PHI, student records, municipal PII), but frequently under-resourced in 24/7 monitoring and patch velocity. This is the classic sweet spot for mid-tier ransomware crews.

Posting Frequency / Escalation

10 postings on a single date (2026-10-27) is a burst pattern, not steady-state drip. Two plausible interpretations: (1) the group cleared a backlog of intrusions and published en masse to maximize pressure; (2) an affiliate exited or the operation is seeding a new leak site to build credibility. Either way, burst publishing historically precedes either escalation (more frequent claims) or a rebrand/dormancy period. Monitor for follow-on postings over the next 7–14 days.

CVE Exposure Hypothesis (sector-level, NOT victim attribution)

We have no evidence linking any named organization to a specific CVE. However, BOOBA PROJECT's class of operation monetizes edge-device and management-plane exploitation, and the following CISA KEV entries (all confirmed ransomware use) represent the attack surface defenders in the targeted sectors should verify immediately:

• CVE-2026-20316 — Cisco Secure FMC hard-coded password: Direct exposure of firewall management infrastructure. Municipal and small healthcare networks frequently run Cisco FMC without compensating controls. This is a top-priority patch.
• CVE-2026-50751 — Check Point Security Gateway improper authentication (IKEv1): VPN gateway compromise — a canonical initial access vector for this gang profile. Check IKEv1 configurations and patch immediately.
• CVE-2026-59310 — VMware vCenter path traversal: Virtualization management-plane access enables mass-encryption of ESXi-hosted workloads — the highest-impact detonation scenario for any ransomware crew.
• CVE-2026-63077 — JetBrains TeamCity deserialization: CI/CD compromise enables supply-chain-adjacent access and credential theft at scale. Relevant to the Nx Console supply-chain CVE below.
• CVE-2026-48027 — Nx Console embedded malicious code: A developer-tool supply-chain vector; relevant to organizations with in-house dev teams, less so to the SMB-heavy claimed victim set.

Detection Engineering

The following detections target the TTPs associated with this class of operation: edge/VPN initial access, phishing-driven execution, RDP brute force, PsExec/WMI lateral movement, data staging before encryption, and shadow copy deletion.

---
title: BOOBA PROJECT - VPN/Firewall Edge Device Exploitation Followed by Internal Recon
id: 8f3a1b2c-boob-4001-9001-aa1000000001
status: experimental
description: Detects suspicious authentication patterns against VPN/firewall management interfaces followed by internal reconnaissance commands, consistent with edge-device exploitation (e.g., CVE-2026-20316, CVE-2026-50751) tradecraft used by mid-tier ransomware crews.
author: Security Arsenal Threat Intelligence
date: 2026/10/28
logsource:
    category: authentication
    product: firewall
detection:
    selection_mgmt:
        dst_port:
            - 443
            - 8443
        action: success
        src_ip|contains: '.'  # external source
    filter_known_admins:
        src_ip|cidr:
            - 10.0.0.0/8
            - 192.168.0.0/16
    condition: selection_mgmt and not filter_known_admins
falsepositives:
    - Legitimate remote admin access from unmanaged IPs (allowlist known admin egress)
level: high
tags:
    - attack.initial_access
    - attack.t1190
    - attack.t1133
---
title: BOOBA PROJECT - RDP Brute Force Followed by Successful Logon
id: 8f3a1b2c-boob-4002-9002-aa1000000002
status: experimental
description: Detects multiple failed RDP logons (Event 4625) from a single source followed by a successful logon (Event 4624 type 10) within a short window — indicative of brute-force initial access commonly purchased from IABs.
author: Security Arsenal Threat Intelligence
date: 2026/10/28
logsource:
    product: windows
    service: security
detection:
    selection_failed:
        EventID: 4625
        LogonType: 10
    selection_success:
        EventID: 4624
        LogonType: 10
    condition: selection_failed | count(SourceNetworkAddress) by SourceNetworkAddress > 10
    timeframe: 10m
falsepositives:
    - Misconfigured service accounts; password-spray by authorized scanners
level: high
tags:
    - attack.credential_access
    - attack.t1110
    - attack.t1021.001
---
title: BOOBA PROJECT - Pre-Encryption Staging (PsExec/WMI Lateral Movement, VSS Deletion, Archive Staging)
id: 8f3a1b2c-boob-4003-9003-aa1000000003
status: experimental
description: Detects the pre-detonation playbook common to double-extortion crews - remote service execution via PsExec/WMI, mass archive creation for exfil staging, and Volume Shadow Copy deletion immediately prior to encryption.
author: Security Arsenal Threat Intelligence
date: 2026/10/28
logsource:
    category: process_creation
    product: windows
detection:
    selection_psexec_wmi:
        - Image|endswith:
            - '\psexec.exe'
            - '\psexesvc.exe'
            - '\wmic.exe'
        - ParentImage|endswith: '\wmiprvse.exe'
    selection_vss:
        Image|endswith:
            - '\vssadmin.exe'
            - '\wmic.exe'
            - '\bcdedit.exe'
        CommandLine|contains:
            - 'delete shadows'
            - 'shadowcopy delete'
            - 'recoveryenabled no'
    selection_staging:
        Image|endswith:
            - '\rar.exe'
            - '\7z.exe'
            - '\winrar.exe'
        CommandLine|contains:
            - ' a '
            - '-r'
    condition: 1 of selection_*
falsepositives:
    - Admin use of PsExec/WMI; backup software interacting with VSS; legitimate archiving
level: critical
tags:
    - attack.lateral_movement
    - attack.t1021.002
    - attack.t1047
    - attack.impact
    - attack.t1490
    - attack.collection
    - attack.t1560.001

The following Sentinel hunt query surfaces the pre-ransomware staging chain: rare outbound remote execution (PsExec/WMI service creation) correlated with bulk file access and archive utility execution within the same host and window — the signature of data theft before encryption.

// BOOBA PROJECT-style pre-encryption staging hunt: lateral movement + data staging correlation
let window = 1h;
let PsExecWMI = SecurityEvent
| where TimeGenerated > ago(7d)
| where EventID == 7045  // service installed
| where ServiceFileName has_any ("PSEXESVC", "ADMIN$", "\\Windows\\") 
    or ServiceName has_any ("PSEXESVC")
| project LateralTime=TimeGenerated, Host=Computer, Account, ServiceName, ServiceFileName;
let ArchiveExec = DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName in~ ("rar.exe","7z.exe","7za.exe","winrar.exe")
    or ProcessCommandLine has_any (" a ", "-mx", ".zip", ".rar", ".7z")
| project StageTime=TimeGenerated, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName;
let VSSDelete = DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where ProcessCommandLine has_any ("delete shadows", "shadowcopy delete", "recoveryenabled no", "vssadmin delete")
| project VSSTime=TimeGenerated, DeviceName, ProcessCommandLine;
PsExecWMI
| join kind=inner (ArchiveExec) on $left.Host == $right.DeviceName
| where StageTime between (LateralTime .. (LateralTime + window))
| join kind=leftouter (VSSDelete) on $left.Host == $right.DeviceName
| project Host, Account, LateralTime, ServiceName, StageTime, ProcessCommandLine, VSSTime, ProcessCommandLine1
| order by LateralTime desc;

The following rapid-response script audits the three highest-value surfaces for this threat profile: exposed RDP, scheduled tasks created in the last 7 days (persistence), and Volume Shadow Copy integrity.

# Security Arsenal Rapid Triage - BOOBA PROJECT exposure check (run elevated)
# 1) RDP exposure: is RDP enabled and listening, and is NLA enforced?
$rdp = Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections -ErrorAction SilentlyContinue
$nla = Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication -ErrorAction SilentlyContinue
$rdpListening = (Get-NetTCPConnection -LocalPort 3389 -State Listen -ErrorAction SilentlyContinue | Measure-Object).Count
Write-Host "[RDP] Enabled: $($rdp.fDenyTSConnections -eq 0) | Listening: $rdpListening | NLA: $($nla.UserAuthentication -eq 1)"
if ($rdp.fDenyTSConnections -eq 0 -and $nla.UserAuthentication -ne 1) { Write-Warning "RDP enabled WITHOUT NLA - remediate immediately" }

# 2) Scheduled tasks created in last 7 days (common affiliate persistence)
$cutoff = (Get-Date).AddDays(-7)
Get-ScheduledTask | ForEach-Object {
    $info = $_ | Get-ScheduledTaskInfo -ErrorAction SilentlyContinue
    $reg = (Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\$($_.TaskPath)$($_.TaskName)" -ErrorAction SilentlyContinue)
    if ($reg) {
        $sd = [System.Text.Encoding]::Unicode.GetString($reg.SD)
    }
    # Use LastTaskResult run history via TaskInfo creation proxy: filter on author/unknown + recent action via event log
} | Out-Null
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-TaskScheduler/Operational'; Id=106; StartTime=$cutoff} -ErrorAction SilentlyContinue |
    Select-Object TimeCreated, @{n='Task';e={$_.Properties[0].Value}}, @{n='User';e={$_.Properties[1].Value}} |
    Format-Table -AutoSize

# 3) Volume Shadow Copy integrity - ransomware playbook deletes these pre-encryption
$shadows = Get-WmiObject Win32_ShadowCopy -ErrorAction SilentlyContinue
Write-Host "[VSS] Shadow copies present: $($shadows.Count)"
if ($shadows.Count -eq 0) { Write-Warning "No shadow copies found - verify VSS was not deleted maliciously" }
Get-WinEvent -FilterHashtable @{LogName='System'; Id=7036; StartTime=$cutoff} -ErrorAction SilentlyContinue |
    Where-Object { $_.Message -match 'Volume Shadow Copy' } | Select-Object TimeCreated, Message | Format-List

Incident Response Priorities

T-Minus Detection Checklist (before encryption fires)

• New services installed referencing PSEXESVC or ADMIN$ paths (Event 7045)
• wmiprvse.exe spawning cmd.exe/powershell.exe on multiple hosts within minutes
• Archive utilities (rar/7z) executing against file shares, document repositories, or EHR/PHI data paths
• vssadmin delete shadows, bcdedit ... recoveryenabled no, or wbadmin delete catalog anywhere in the fleet — treat as imminent detonation
• Anomalous VPN/firewall management-plane logins from external IPs (CVE-2026-20316, CVE-2026-50751 exposure)
• Large outbound transfers to unfamiliar cloud storage or bulletproof-host ASNs in off-hours

Assets This Gang's Class Prioritizes for Exfiltration

Given the claimed victim mix, expect targeting of: PHI/EHR databases and billing records (healthcare claims), student records and donor/constituent PII (education/museum claims), and municipal records — utility billing, police/court documents, HR files (township/city claims). These data classes maximize double-extortion leverage against regulated SMBs.

Containment Actions (ordered by urgency)

1. Isolate affected VLANs/hosts at the switch and EDR level — do not power off (preserve memory for forensics).
2. Disable compromised accounts and force enterprise-wide credential resets, prioritizing domain admin and service accounts; assume Kerberos ticket theft and revoke sessions.
3. Block egress at the perimeter to unknown destinations; kill active exfil channels before focusing on encryption.
4. Snapshot/preserve hypervisor state if vCenter compromise is suspected (CVE-2026-59310) — ESXi mass-encryption is the worst-case outcome.
5. Verify backup integrity and offline immutability before any recovery declaration; this gang profile deletes shadow copies as standard practice.
6. Engage IR counsel early — healthcare and municipal entities have strict notification clocks regardless of whether the threat actor's claim is verified.

Hardening Recommendations

Immediate (24 hours)

• Patch edge devices: Cisco Secure FMC (CVE-2026-20316) and Check Point gateways (CVE-2026-50751) are the highest-probability entry points for this threat class. If unpatched, restrict management interfaces to a dedicated admin VLAN.
• Audit and restrict RDP: Disable internet-facing RDP entirely; enforce NLA; place remaining RDP behind VPN with MFA.
• MFA on all remote access and email — phishing-driven credential theft remains the fallback access vector.
• Block macro execution from internet-sourced Office files via GPO/ASR rules.
• Deploy the Sigma rules above and enable the VSS-deletion and PsExec/WMI alerts at critical severity.
• Verify offline/immutable backups and test one restore today.

Short-Term (2 weeks)

• Segment the network so that EHR, student records, and municipal data stores sit in isolated zones with no direct workstation-to-server lateral paths.
• Deploy EDR with ransomware canary files on file shares and hypervisor management interfaces.
• Harden vCenter/ESXi (CVE-2026-59310): patch, restrict to jump-host access, and enable lockdown mode where feasible.
• Egress filtering and DLP on bulk archive transfers — data theft is the leverage; cut the exfil path and the extortion model weakens substantially.
• Tabletop a leak-site scenario: Legal, comms, and IR should rehearse the response to being named on a criminal leak site — including the reality that a claim is not a confirmed breach and that response posture must be evidence-driven.

Analyst Note

BOOBA PROJECT's burst posting pattern warrants monitoring over the next two weeks. If the operation follows the mid-tier playbook, expect either a second batch or a quiet period preceding a rebrand. Organizations named in the claims have not confirmed any incident, and this briefing makes no assertion that any breach occurred. Defenders in the targeted sectors should act on the exposure, not the claim.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub