Classification: TLP:CLEAR | Publication Date: 2026-10-22 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

BOOBA PROJECT Ransomware Gang: 6 New Leak-Site Listings Targeting US Government, Healthcare & Education

Executive Summary

On 2026-10-20, the BOOBA PROJECT ransomware operation posted six new listings to its dark web leak site, all naming United States-based organizations. The listings span three sectors: Government & Defense (two municipal entities), Healthcare (three organizations), and Education (one academic research foundation). Every listing in this batch is a claim by the threat actor — none have been independently corroborated by a second leak-site crawler, and no listing confirms that a breach occurred.

Regardless of verification status, this batch is operationally significant: a concentrated, single-day posting wave against US municipalities and healthcare providers is consistent with BOOBA PROJECT's historical pattern of timed multi-victim drops designed to maximize pressure and media attention. Security teams at municipal governments, pediatric and specialty healthcare practices, and academic research organizations should treat this as a trigger for proactive threat hunting against the TTPs documented below — not as confirmation that any named entity has been compromised.

The six organizations named on the leak site are:

• City Hall - Everett, MA (Government & Defense, US)
• City of Mt. Angel, Oregon (Government & Defense, US)
• Pearland Pediatrics (Healthcare, US)
• Chicago Vein Institute (Healthcare, US)
• Research Foundation of The City University of New York (Education, US)
• COASTAL CAROLINA NEUROPSYCHIATRIC CENTER, PA (Healthcare, US)

Sourcing & Verification

• 0 of 6 listings in this batch were independently observed by a second leak-site crawler. All 6 are single-source, appearing only on ransomware.live's monitoring of the BOOBA PROJECT .onion site.
• Inclusion in this briefing reflects the threat actor's claim only. A leak-site posting is an accusation by a criminal organization. It is not confirmation of a breach, and no corroboration tier in our data confirms that a breach occurred — only the named organization or its regulator can do that.
• A named organization may dispute a listing. A denial is likewise not proof that the claim is false: disclosure obligations vary by jurisdiction and sector, not every incident is reportable, and neither silence nor denial settles the question.
• Security Arsenal will publish corrections as warranted and welcomes contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — BOOBA PROJECT

Model & Aliases: BOOBA PROJECT operates as a closed-group ransomware operation rather than an open Ransomware-as-a-Service (RaaS) program. Unlike affiliate-driven families, BOOBA PROJECT maintains a tight operator core, which produces more consistent TTPs across victims but lower overall victim volume. The group brands its leak site under the "BOOBA PROJECT" name; no widely adopted alternate aliases have been confirmed in the underground ecosystem, though chatter occasionally cross-references its infrastructure with recycled tooling from defunct operations.

Ransom Demands: Demands attributed to this group typically fall in the mid-five-figure to low-seven-figure USD range, scaled to victim size. Municipalities and small-to-midsize healthcare practices — exactly the profile in this batch — are targeted because they historically carry cyber-insurance policies with payout pressure but lack mature SOC coverage.

Initial Access Methods (historical, sector-level):

• Spear phishing with macro-enabled documents and malicious links (most common vector)
• Exploitation of internet-facing remote access services: unpatched VPN concentrators, exposed RDP, and firewall management interfaces
• Credential stuffing and brute force against RDP and VPN portals lacking MFA
• Occasional use of compromised managed service provider (MSP) tooling as a supply-chain pivot

Extortion Model: Double extortion. The group stages and exfiltrates data before detonating encryption, then posts victim names to its leak site with countdown timers to pressure payment. Data threatened includes PII, patient records, financial documents, and internal correspondence.

Dwell Time: Observed dwell time for comparable closed-group operations targeting this victim profile typically ranges from 5 to 21 days between initial access and encryption, with a staging/exfiltration burst in the final 48–72 hours. This window is the defender's opportunity: pre-encryption behavior is noisy and detectable.

Current Campaign Analysis

Sector Targeting: The batch skews heavily toward entities holding regulated data:

• Government & Defense (2/6): Two municipal governments — City Hall - Everett, MA and the City of Mt. Angel, Oregon. Small municipalities are classic soft targets: legacy infrastructure, limited security staffing, and politically intolerable service downtime.
• Healthcare (3/6): Pearland Pediatrics, Chicago Vein Institute, and COASTAL CAROLINA NEUROPSYCHIATRIC CENTER, PA. Small specialty and pediatric practices hold dense PHI with minimal segmentation between clinical and administrative systems.
• Education (1/6): Research Foundation of The City University of New York — a target class that blends research IP with grants/financial data.

Geographic Concentration: 100% United States. The group is either deliberately avoiding jurisdictions with elevated law-enforcement heat or concentrating where insurance-driven payment likelihood is highest.

Victim Profile: Small-to-midsize organizations. Municipalities of modest population; single-practice or small-group healthcare providers; a university-affiliated foundation. Estimated annual revenues/budgets range from low single-digit millions (small practices, small towns) to tens of millions (larger municipal and academic entities). This is a deliberate selection band: large enough to pay, small enough to lack 24/7 detection.

Posting Frequency / Escalation Pattern: All six listings carry the same publication date (2026-10-20) — a synchronized batch drop rather than a drip. This is a pressure tactic and typically indicates the claims were assembled over a preceding window and released together for impact. Single-source status on all six means we cannot rule out re-posted or inflated claims; defenders should weigh accordingly.

CVE Correlation (HYPOTHESIS ONLY): We have no evidence linking any specific CVE to any specific listing above. However, BOOBA PROJECT's documented reliance on exploiting internet-facing infrastructure aligns with several entries currently on the CISA Known Exploited Vulnerabilities catalog with confirmed ransomware use. Organizations in the targeted sectors should treat the following as priority patch candidates given the group's known access patterns:

• CVE-2026-20316 (Cisco Secure Firewall Management Center, hard-coded password) — network-edge compromise fits the group's perimeter-first style.
• CVE-2026-50751 (Check Point Security Gateway, improper authentication in IKEv1) — VPN gateway exploitation is a documented initial access method for this actor class.
• CVE-2026-59310 (VMware vCenter path traversal) — vCenter compromise enables mass hypervisor-level encryption, a hallmark of modern double-extortion detonation.
• CVE-2026-63077 (JetBrains TeamCity deserialization) — CI/CD compromise as a software supply-chain pivot.
• CVE-2026-48027 (Nx Console embedded malicious code) — developer-toolchain supply-chain exposure.

These are sector-level exposure hypotheses, not attribution of a vector to any named organization.

Detection Engineering

The following detections target the TTPs this group is known to use: perimeter/VPN initial access, macro-driven phishing execution, RDP brute force, PsExec/WMI lateral movement, Cobalt Strike-style beaconing, and pre-encryption data staging and shadow copy deletion.

---
title: Suspicious Office Macro Spawning Script Interpreter - BOOBA PROJECT Phishing Pattern
id: 8f3a2b11-b00b-4a01-9001-000000000001
status: experimental
description: Detects Microsoft Office applications spawning script interpreters or command shells, consistent with BOOBA PROJECT macro-based phishing initial access.
author: Security Arsenal Threat Intelligence
date: 2026/10/22
references:
  - https://securityarsenal.com/darkside
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\winword.exe'
      - '\excel.exe'
      - '\powerpnt.exe'
      - '\outlook.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare legitimate Office add-ins
level: high
tags:
  - attack.initial_access
  - attack.t1566.001
  - attack.t1059
---
title: RDP Brute Force Followed by Successful Logon - BOOBA PROJECT Access Pattern
id: 8f3a2b11-b00b-4a01-9001-000000000002
status: experimental
description: Detects a burst of failed RDP/network logons (Event 4625, logon type 3 or 10) followed by a successful logon (4624) from the same source, indicative of brute-force RDP/VPN-adjacent access used by BOOBA PROJECT.
author: Security Arsenal Threat Intelligence
date: 2026/10/22
logsource:
  product: windows
  service: security
detection:
  selection_failed:
    EventID: 4625
    Logon_Type:
      - 3
      - 10
  selection_success:
    EventID: 4624
    Logon_Type:
      - 3
      - 10
  condition: selection_failed | count() by Source_Network_Address > 10
  timeframe: 10m
falsepositives:
  - Misconfigured service accounts
  - Vulnerability scanners
level: medium
tags:
  - attack.credential_access
  - attack.t1110
  - attack.t1021.001
---
title: Pre-Ransomware Staging - Shadow Copy Deletion and Bulk Archive Creation
id: 8f3a2b11-b00b-4a01-9001-000000000003
status: experimental
description: Detects Volume Shadow Copy deletion via vssadmin/wmic and mass archive creation with 7z/rar, consistent with BOOBA PROJECT pre-encryption staging and anti-recovery behavior.
author: Security Arsenal Threat Intelligence
date: 2026/10/22
logsource:
  category: process_creation
  product: windows
detection:
  selection_vss:
    - Image|endswith: '\vssadmin.exe'
      CommandLine|contains: 'delete shadows'
    - Image|endswith: '\wmic.exe'
      CommandLine|contains: 'shadowcopy'
    - Image|endswith: '\bcdedit.exe'
      CommandLine|contains: 'recoveryenabled'
  selection_archive:
    Image|endswith:
      - '\7z.exe'
      - '\7za.exe'
      - '\rar.exe'
      - '\winrar.exe'
  condition: 1 of selection_vss or selection_archive
falsepositives:
  - Legitimate backup maintenance (rare for vssadmin delete)
  - IT archiving workflows
level: high
tags:
  - attack.impact
  - attack.t1490
  - attack.t1560.001

// Hunt: BOOBA PROJECT-style lateral movement + pre-encryption staging
// Look for PsExec-style service creation, WMI remote execution, and staging tools
// within a 7-day window across endpoints.
let Lookback = 7d;
let SuspiciousRemoteExec =
    DeviceProcessEvents
    | where Timestamp > ago(Lookback)
    | where (FileName =~ "psexec.exe" or FileName =~ "psexesvc.exe"
        or (FileName =~ "wmic.exe" and ProcessCommandLine has_any ("process call create", "/node:"))
        or (FileName =~ "wmiprvse.exe" and InitiatingProcessFileName !in~ ("svchost.exe", "winmgmt.exe")))
    | project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, RemoteIP=IPAddress;
let StagingTools =
    DeviceProcessEvents
    | where Timestamp > ago(Lookback)
    | where FileName in~ ("7z.exe", "7za.exe", "rar.exe", "winrar.exe", "megacmd.exe", "rclone.exe")
    | project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine;
let AntiRecovery =
    DeviceProcessEvents
    | where Timestamp > ago(Lookback)
    | where (FileName =~ "vssadmin.exe" and ProcessCommandLine has "delete shadows")
        or (FileName =~ "bcdedit.exe" and ProcessCommandLine has "recoveryenabled")
    | project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine;
SuspiciousRemoteExec
| union StagingTools, AntiRecovery
| summarize FirstSeen=min(Timestamp), LastSeen=max(Timestamp), Signals=make_set(FileName), SignalCount=dcount(FileName)
    by DeviceName, AccountName
| where SignalCount >= 2
| sort by SignalCount desc, LastSeen desc

<#
.SYNOPSIS
  BOOBA PROJECT Rapid Triage - pre-ransomware staging and access indicators.
.DESCRIPTION
  Checks: (1) recently created scheduled tasks (7 days), (2) RDP exposure &
  NLA status, (3) shadow copy inventory, (4) suspicious staging archives,
  (5) recent local admin additions. Run elevated on suspect hosts or via your RMM.
#>
$ErrorActionPreference = 'SilentlyContinue'
$Cutoff = (Get-Date).AddDays(-7)
$Report = [ordered]@{}

Write-Host "`n=== [1] Scheduled Tasks Created in Last 7 Days ===" -ForegroundColor Cyan
$tasks = Get-ScheduledTask | Where-Object { $_.Date -gt $Cutoff } |
  Select-Object TaskName, TaskPath, Date, @{n='Action';e={($_.Actions | ForEach-Object { $_.Execute }) -join '; '}}
$tasks | Format-Table -AutoSize
$Report['NewScheduledTasks'] = $tasks

Write-Host "`n=== [2] RDP Exposure Check ===" -ForegroundColor Cyan
$rdpEnabled = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server').fDenyTSConnections -eq 0
$nla = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp').UserAuthentication
$rdpListening = (Get-NetTCPConnection -LocalPort 3389 -State Listen) -ne $null
Write-Host ("RDP Enabled: {0} | Listening on 3389: {1} | NLA Required: {2}" -f $rdpEnabled, $rdpListening, ($nla -eq 1))
if ($rdpEnabled -and $nla -ne 1) { Write-Host "[!] RISK: RDP without NLA — brute-force target." -ForegroundColor Red }
$Report['RDP'] = @{ Enabled=$rdpEnabled; Listening=$rdpListening; NLA=($nla -eq 1) }

Write-Host "`n=== [3] Volume Shadow Copy Inventory ===" -ForegroundColor Cyan
$shadows = Get-CimInstance Win32_ShadowCopy
if (-not $shadows) { Write-Host "[!] NO shadow copies present — verify whether deleted (vssadmin delete shadows)." -ForegroundColor Red }
else { $shadows | Select-Object ID, InstallDate, VolumeName | Format-Table -AutoSize }
$Report['ShadowCopies'] = @($shadows).Count

Write-Host "`n=== [4] Large Archives Created in Last 7 Days (staging hunt) ===" -ForegroundColor Cyan
$archives = Get-ChildItem -Path C:\ -Recurse -Include *.zip,*.7z,*.rar -ErrorAction SilentlyContinue |
  Where-Object { $_.CreationTime -gt $Cutoff -and $_.Length -gt 100MB } |
  Select-Object FullName, CreationTime, @{n='SizeMB';e={[math]::Round($_.Length/1MB,1)}}
$archives | Format-Table -AutoSize
$Report['StagingArchives'] = $archives

Write-Host "`n=== [5] Local Administrators Group Membership ===" -ForegroundColor Cyan
$admins = Get-LocalGroupMember -Group 'Administrators'
$admins | Format-Table -AutoSize
$Report['LocalAdmins'] = $admins.Name

Write-Host "`nTriage complete. Review flagged items against BOOBA PROJECT TTPs before detonation window closes." -ForegroundColor Green

Incident Response Priorities

T-Minus Detection Checklist (before encryption fires):

1. Burst of failed then successful RDP/VPN logons from unfamiliar geographies or ASNs, especially outside business hours.
2. New scheduled tasks or services created with encoded PowerShell or living-off-the-land binaries (rundll32, mshta, wscript).
3. PsExec service artifacts (PSEXESVC), remote WMI process call create events, or unexpected wmiprvse.exe spawning shells.
4. Archive utilities (7z, rar, WinRAR) executing against document shares, EHR exports, or finance directories.
5. Outbound transfer spikes to cloud storage, MEGA, or unknown endpoints — the 48–72 hour exfil window.
6. vssadmin delete shadows, bcdedit tampering, or backup-agent service stops — the final pre-detonation move.

Critical Assets This Gang Historically Prioritizes for Exfiltration:

• Patient records / PHI exports (healthcare victims) — maximum regulatory leverage.
• Municipal HR files, payroll, police/utility records (government victims).
• Financial statements, grant and donor data (education/foundation victims).
• Email archives and legal correspondence for reputational pressure.

Containment Actions, Ordered by Urgency:

1. Isolate the affected segment at the switch/firewall level — do not power off hosts (preserve volatile evidence).
2. Disable compromised accounts and force enterprise-wide credential resets, prioritizing domain admins and service accounts.
3. Block identified exfil destinations at the egress proxy; enable TLS inspection where legally permissible.
4. Kill active remote access paths: disable RDP externally, revoke active VPN sessions, rotate firewall/VPN appliance credentials.
5. Verify backup integrity and move one copy fully offline/immutable before attackers reach backup infrastructure.
6. Engage IR counsel and, for healthcare entities, evaluate HIPAA Breach Notification Rule timelines against what can actually be verified — do not treat the leak-site claim alone as a reportable determination.

Hardening Recommendations

Immediate (24 hours):

• Enforce MFA on all remote access (VPN, RDP gateways, firewall management portals) — this single control breaks the group's most common entry path.
• Disable RDP from the internet entirely; require VPN + jump host for administrative access.
• Patch or mitigate the KEV entries above — prioritize CVE-2026-20316 (Cisco FMC) and CVE-2026-50751 (Check Point) at the perimeter, CVE-2026-59310 (vCenter) internally.
• Deploy the Sigma rules above; alert on any vssadmin delete shadows execution as page-the-on-call severity.
• Audit and restrict local administrator group membership on all servers.

Short-Term (2 weeks):

• Implement application control (WDAC/AppLocker) blocking Office child processes and unauthorized archive utilities on servers.
• Segment networks so a single compromised workstation cannot reach hypervisor management (vCenter/ESXi) or backup infrastructure.
• Deploy immutable, off-network backups with tested restoration runbooks for municipal and clinical systems.
• Enable PowerShell script block logging, command-line process auditing, and forward all endpoint telemetry to a monitored SIEM with the KQL hunt above scheduled daily.
• Conduct a tabletop exercise simulating this exact scenario: leak-site claim against your organization, verification workflow, and disclosure decision tree.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub