BOOBA PROJECT Ransomware Gang: 2 New Victims Posted — Financial & Professional Services Targeting Analysis with Detection Rules

Classification: TLP:AMBER | Report Date: 2026-08-24 | Source: ransomware.live monitoring of criminal leak-site infrastructure | Confidence: Moderate (direct leak-site observation; actor TTP attribution inferred from associated KEV telemetry)

1. Executive Summary

On 2026-08-24, monitoring of the BOOBA PROJECT dark web leak site confirmed two new victim postings in a single 24-hour window:

• Country-Wide Insurance — Financial Services, United States
• Federis Abogados — Professional Services (legal), Mexico

The dual posting on the same date suggests either a synchronized detonation/extortion cycle or backlog batch-publishing — both are escalation indicators. The cluster of CISA KEV vulnerabilities associated with this actor's ecosystem points to an initial-access playbook built around edge-device and remote-access exploitation (Check Point Security Gateway, ConnectWise ScreenConnect, Microsoft Exchange) rather than mass phishing alone. Financial services, insurance, legal, and professional services organizations in the US and Latin America should treat this as an active threat and immediately execute the hunt queries in Section 5.

2. Threat Actor Profile — BOOBA PROJECT

Analyst note: BOOBA PROJECT is a low-signal actor. There is no confirmed public alias history, so defenders should not anchor on name-based IOCs. Anchor on behavior: edge-device compromise → living-off-the-land recon → staging → mass encryption → leak-site publication.

3. Current Campaign Analysis

Sectors Targeted

• Financial Services / Insurance (Country-Wide Insurance): high-value PII, policyholder financial data, regulatory leverage (state insurance commissioners, potential NYDFS 500 / GLBA exposure).
• Professional Services / Legal (Federis Abogados): privileged client communications, case files, M&A and litigation data — extremely high extortion leverage per gigabyte.

Both sectors share a common trait: confidentiality is the product. This confirms double extortion is the core business model, not an afterthought.

Geographic Concentration

US + Mexico in the same posting cycle suggests a US/LATAM corridor focus. This is consistent with actors deliberately targeting Latin American professional services firms (often weaker EDR coverage, flatter networks) alongside US mid-market enterprises for headline pressure.

Victim Profile

• Country-Wide Insurance: regional/mid-market insurer, estimated revenue $50M–$500M, 200–2,000 employees — the classic "big enough to pay, small enough to lack 24/7 SOC" ransomware sweet spot.
• Federis Abogados: boutique/mid-size law firm, estimated $5M–$50M revenue — legal firms are disproportionately targeted for data theft over encryption impact.

Posting Frequency / Escalation

Two postings in one day after a quiet period is a batch-publication pattern: victims who refused to pay are posted simultaneously to maximize pressure on current negotiations. If your organization is mid-incident with this group, assume a publication deadline exists and is short.

CVE Connection — Probable Initial Access Vectors

The KEV cluster maps cleanly onto a coherent kill chain:

1. CVE-2026-50751 (Check Point IKEv1 improper auth) — unauthenticated perimeter entry. Patch/mitigate immediately if Check Point gateways are internet-facing.
2. CVE-2024-1708 (ScreenConnect path traversal → RCE) — RMM abuse; also check for unauthorized ScreenConnect/AnyDesk/TeamViewer installs, a hallmark persistence mechanism.
3. CVE-2023-21529 (Exchange deserialization) — authenticated RCE for mailbox-rich environments (both victim sectors are Exchange-heavy).
4. CVE-2025-60710 (Windows link following) — privilege escalation to SYSTEM post-foothold.
5. CVE-2026-48027 (Nx Console malicious code) — developer workstation supply-chain entry; relevant if legal/financial orgs have in-house dev teams or vendors using Nx.

4. MITRE ATT&CK Mapping (Assessed)

5. Detection Engineering

Sigma Rules

---
title: Check Point IKEv1 Authentication Bypass Exploitation Attempt - BOOBA PROJECT TTP
id: 8f3a2b41-7c2e-4d91-9a55-b00ba0000001
status: experimental
description: Detects anomalous IKEv1 negotiation patterns consistent with exploitation of CVE-2026-50751 improper authentication on Check Point Security Gateway, an assessed BOOBA PROJECT initial access vector.
author: Security Arsenal Threat Intelligence
date: 2026/08/24
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
  product: checkpoint
  service: vpn
detection:
  selection_auth_fail:
    ike_version: 'IKEv1'
    auth_result|contains:
      - 'failed'
      - 'denied'
      - 'bypass'
  selection_anomaly:
    src_ip_geo|contains:
      - 'TOR'
      - 'unknown'
    session_duration|lt: 5
  condition: selection_auth_fail or (selection_anomaly and 1 of selection_*)
falsepositives:
  - Misconfigured VPN clients with legacy IKEv1 settings
level: high
tags:
  - attack.initial_access
  - attack.t1190
  - cve.2026.50751
---
title: Unauthorized RMM Tool Installation or ScreenConnect Execution - BOOBA PROJECT TTP
id: 8f3a2b41-7c2e-4d91-9a55-b00ba0000002
status: experimental
description: Detects installation or execution of remote monitoring and management tools (ScreenConnect, AnyDesk, TeamViewer, Atera) commonly deployed by ransomware actors including BOOBA PROJECT after CVE-2024-1708 exploitation for persistence.
author: Security Arsenal Threat Intelligence
date: 2026/08/24
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\ScreenConnect.ClientService.exe'
      - '\ScreenConnect.Service.exe'
      - '\AnyDesk.exe'
      - '\TeamViewer_Service.exe'
      - '\AteraAgent.exe'
      - '\splashtop.exe'
  selection_install:
    CommandLine|contains:
      - 'install'
      - 'msiexec'
      - '/quiet'
      - '/S'
  filter_approved_paths:
    Image|startswith:
      - 'C:\Program Files\ApprovedIT\'
  condition: selection_img and selection_install and not filter_approved_paths
falsepositives:
  - Legitimate IT RMM deployments — maintain an approved-path exclusion list
level: high
tags:
  - attack.persistence
  - attack.t1219
  - attack.t1133
  - cve.2024.1708
---
title: Pre-Ransomware Staging - VSS Deletion and Bulk Archive Creation
id: 8f3a2b41-7c2e-4d91-9a55-b00ba0000003
status: experimental
description: Detects Volume Shadow Copy deletion combined with mass archive creation — the pre-encryption staging behavior observed across double-extortion ransomware campaigns matching BOOBA PROJECT's assessed playbook.
author: Security Arsenal Threat Intelligence
date: 2026/08/24
logsource:
  category: process_creation
  product: windows
detection:
  selection_vss:
    CommandLine|contains:
      - 'vssadmin delete shadows'
      - 'vssadmin Delete Shadows'
      - 'wmic shadowcopy delete'
      - 'bcdedit /set {default} recoveryenabled no'
      - 'wbadmin delete catalog'
  selection_archive:
    Image|endswith:
      - '\7z.exe'
      - '\rar.exe'
      - '\winrar.exe'
    CommandLine|contains:
      - ' -p'
      - ' a '
  condition: selection_vss or selection_archive
falsepositives:
  - Backup software maintenance windows
  - Admin scripting of archive creation — tune with parent process allowlists
level: critical
tags:
  - attack.impact
  - attack.t1490
  - attack.t1560
  - attack.t1074

KQL — Microsoft Sentinel Hunt: Lateral Movement and Pre-Detonation Staging

// BOOBA PROJECT hunt: correlate edge-device logon anomalies with lateral movement and staging
// Run over last 14 days (assessed dwell-time window for edge-entry ransomware actors)
let Lookback = 14d;
let SuspiciousLogons =
    SigninLogs
    | where TimeGenerated > ago(Lookback)
    | where AppDisplayName has_any ("VPN", "CheckPoint", "Check Point")
    | where ResultType == 0
    | summarize LogonCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
        by UserPrincipalName, IPAddress, Location
    | where LogonCount < 3  // rare/first-time VPN source IPs
    | extend FirstSeen = FirstSeen, LastSeen = LastSeen;
let LateralMovement =
    DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where FileName in~ ("psexec.exe", "psexesvc.exe", "wmic.exe")
       or (FileName =~ "wmiprvse.exe" and InitiatingProcessFileName !in~ ("svchost.exe", "sccm.exe"))
       or ProcessCommandLine has_any ("\\\\", "admin$", "c$", "ipc$")
    | summarize LateralCount = count(), Tools = make_set(FileName)
        by DeviceName, AccountName, bin(TimeGenerated, 1h);
let Staging =
    DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where ProcessCommandLine has_any ("vssadmin delete shadows", "shadowcopy delete",
        "recoveryenabled no", "wbadmin delete")
       or (FileName in~ ("7z.exe", "rar.exe") and ProcessCommandLine has " -p")
    | project StagingTime = TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine;
SuspiciousLogons
| join kind=leftouter (LateralMovement) on $left.UserPrincipalName contains $right.AccountName
| join kind=leftouter (Staging) on $left.Location != "" and $right.DeviceName != ""
| project UserPrincipalName, IPAddress, Location, LogonCount, LateralCount, Tools,
          StagingTime, FileName, ProcessCommandLine
| where isnotempty(LateralCount) or isnotempty(StagingTime)
| order by StagingTime desc;

Analyst guidance: Any row returning a staging hit (vssadmin delete shadows) on a server class asset is a P1 — assume detonation is imminent (hours, not days) and move directly to the containment playbook in Section 6.

PowerShell — Rapid Triage & Hardening Script

# BOOBA-PROJECT-RapidTriage.ps1
# Run elevated on domain controllers and critical servers. Outputs to C:\IR-Triage\
$OutDir = "C:\IR-Triage\$(Get-Date -Format 'yyyyMMdd-HHmm')"
New-Item -ItemType Directory -Path $OutDir -Force | Out-Null

Write-Host "[*] 1. Checking RDP exposure and recent RDP logons..." -ForegroundColor Cyan
Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server' |
    Select-Object fDenyTSConnections |
    Export-Csv "$OutDir\rdp-config.csv" -NoTypeInformation
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624; LogonType=10} -MaxEvents 200 -ErrorAction SilentlyContinue |
    Select-Object TimeCreated, @{n='Account';e={$_.Properties[5].Value}}, @{n='SourceIP';e={$_.Properties[18].Value}} |
    Export-Csv "$OutDir\rdp-logons.csv" -NoTypeInformation

Write-Host "[*] 2. Scheduled tasks created/modified in last 7 days (persistence check)..." -ForegroundColor Cyan
Get-ScheduledTask | Where-Object { $_.Date -gt (Get-Date).AddDays(-7) -or $_.LastTaskResult -ne $null } |
    ForEach-Object {
        $info = $_ | Get-ScheduledTaskInfo -ErrorAction SilentlyContinue
        [PSCustomObject]@{ TaskName=$_.TaskName; Path=$_.TaskPath; State=$_.State;
            Author=$_.Author; LastRun=$info.LastRunTime }
    } | Export-Csv "$OutDir\recent-scheduled-tasks.csv" -NoTypeInformation

Write-Host "[*] 3. Volume Shadow Copy inventory (should NOT be empty on servers)..." -ForegroundColor Cyan
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
if (-not $shadows) { Write-Host "[!!!] NO SHADOW COPIES FOUND - possible T1490 anti-recovery activity" -ForegroundColor Red }
$shadows | Select-Object InstallDate, DeviceObject, VolumeName | Export-Csv "$OutDir\shadow-copies.csv" -NoTypeInformation

Write-Host "[*] 4. Unauthorized RMM tool sweep..." -ForegroundColor Cyan
$rmm = @("ScreenConnect","AnyDesk","TeamViewer","Atera","Splashtop","LogMeIn","RustDesk")
Get-CimInstance Win32_Product -ErrorAction SilentlyContinue | Where-Object {
    $n = $_.Name; $rmm | Where-Object { $n -like "*$_*" }
} | Select-Object Name, InstallDate, Vendor | Export-Csv "$OutDir\rmm-tools.csv" -NoTypeInformation
Get-Process | Where-Object { $p=$_.ProcessName; $rmm | Where-Object { $p -like "*$_*" } } |
    Select-Object ProcessName, Id, Path | Export-Csv "$OutDir\rmm-running.csv" -NoTypeInformation

Write-Host "[*] 5. Local admins modified in last 14 days (privesc check - CVE-2025-60710)..." -ForegroundColor Cyan
Get-LocalGroupMember -Group "Administrators" -ErrorAction SilentlyContinue |
    Select-Object Name, ObjectClass, PrincipalSource | Export-Csv "$OutDir\local-admins.csv" -NoTypeInformation

Write-Host "[*] Triage complete. Bundle $OutDir for your IR retainer." -ForegroundColor Green

6. Incident Response Priorities — BOOBA PROJECT Playbook

T-Minus Detection Checklist (Before Encryption Fires)

• Check Point gateway logs: IKEv1 authentication anomalies, new admin sessions, config exports (CVE-2026-50751)
• New RMM processes anywhere in the estate — treat any non-allowlisted RMM as malicious by default
• Exchange: w3wp.exe spawning cmd.exe/powershell.exe (deserialization post-exploitation, CVE-2023-21529)
• vssadmin delete shadows / bcdedit / wbadmin delete on any server → P1, assume detonation < 24h
• Password-protected 7z/RAR archives appearing in user temp directories or file server roots (staging)
• Egress spikes to consumer cloud storage (MEGA, Dropbox, file.io, temp.sh) from servers that never upload
• PsExec service installs (Event ID 7045 with PSEXESVC) across multiple hosts in < 1 hour

Critical Assets This Profile Historically Prioritizes for Exfiltration

1. Policyholder/client databases (insurance) — PII + financial records
2. Privileged communications (legal) — case files, attorney-client correspondence
3. Email archives / Exchange mailbox exports — leverage material for negotiation
4. Financial records, payroll, tax documents — secondary extortion leverage
5. Backup catalogs and credentials — destroyed or exfiltrated pre-encryption

Containment Actions — Ordered by Urgency

1. Isolate, don't reboot: VLAN-quarantine hosts showing staging indicators. Reboots can trigger encryption logic and destroy volatile evidence.
2. Kill the edge: Force-reset all VPN/Check Point sessions, disable IKEv1 if feasible, rotate all gateway credentials and certificates.
3. Disable suspect RMM: Block RMM executables via AppLocker/WDAC at the estate level; uninstall unauthorized instances.
4. Credential hygiene: Reset domain admin, service account, and any account observed in lateral movement telemetry. Assume krbtgt compromise if DCs were touched (double-reset).
5. Protect backups: Take backup infrastructure offline/air-gap immediately; verify immutable snapshot integrity before any restore planning.
6. Egress choke: Block outbound to consumer file-sharing/cloud storage at the proxy.
7. Preserve evidence: Memory capture on staging hosts before isolation; export VPN/EDR/Exchange logs to a secure collector.

7. Hardening Recommendations

Immediate (24 Hours)

• Patch/mitigate CVE-2026-50751 on all internet-facing Check Point gateways — this is the highest-probability entry vector. If patching isn't possible, disable IKEv1 or restrict VPN source IPs.
• Patch CVE-2024-1708 (ScreenConnect) or decommission the instance; sweep for unauthorized RMM estate-wide using the script in Section 5.
• Patch CVE-2023-21529 and CVE-2025-60710 on Exchange and Windows fleets.
• Enable tamper protection on EDR; alert on any vssadmin delete shadows execution as critical.
• Enforce MFA on all VPN and remote access — no exceptions for service accounts.
• Block execution of 7z.exe/rar.exe on servers via AppLocker (users don't compress on servers).

Short-Term (2 Weeks)

• Segment backup infrastructure onto a separate, non-domain-joined management plane with immutable storage (WORM/object lock).
• Deploy deception: honeypot file shares with canary documents; actors staging data will touch them.
• Implement egress data-loss controls: alert on > 5GB outbound per host per hour to non-corporate destinations.
• Audit developer tooling for Nx Console versions affected by CVE-2026-48027; rotate any secrets accessible from developer workstations during the exposure window.
• Stand up the Section 5 KQL hunt as a scheduled Sentinel analytic rule (every 4 hours) covering VPN anomalies → lateral movement → staging correlation.
• Review cyber insurance and IR retainer terms — for financial/legal sector orgs, confirm breach counsel availability given the regulatory notification timelines this sector faces.

Analyst Closing Note

BOOBA PROJECT is a low-volume operator, which makes it easy to dismiss — and dangerous to ignore. Low-volume actors are often more deliberate: fewer victims, more time per intrusion, better operational security. The sector pairing here (insurance + legal) is a data-theft-first strategy. If you operate in financial services or professional services in the US or LATAM and run Check Point at the edge, assume you are in scope and hunt today.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub