Security1 publisher2 min readPublished
Booba ransomware gang claims 344 GB from University of Illinois Chicago's College of Medicine
University of Illinois Chicago confirmed hackers stole data from its College of Medicine servers in a ransomware attack the Booba gang says netted 344 GB. The outage stayed inside one of UIC's 16 colleges, and the investigation into whose records were taken is still open.
The Watch · Security desk
Drafted by a language model from the sources cited here and checked against its claim ledger before publication. How we use AISend a correction
What happened
- Some College of Medicine systems were temporarily unavailable during the attack, and UIC says all of them have since been restored.
- UIC reported the incident to law enforcement and coordinated its recovery with agencies throughout the restoration.
- Booba, which emerged at the end of July, has already claimed 49 attacks.
- In an earlier Booba-linked attack on Merrimack County, New Hampshire, dispatchers could not pull criminal data from state software to share with officers, Patch reported.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- constraint Keeping the attack off UIC's main network limited the outage to one college, but the files were taken from that college's own servers, so the gang still holds stolen data to extort with.
- exposure Anyone whose records sat on College of Medicine servers will not know whether they are exposed until UIC finishes its review, and Booba keeps whatever it took in the meantime.
- capability Booba's Linux variant means Linux servers can be encrypted alongside Windows machines, so defences built only around Windows endpoints leave part of a victim's systems unprotected.
"The university's main network was not affected, and there was no impact on patient care delivery at UI Health," a UIC spokesperson told Recorded Future News [4]. The college the attack reached has about 1,300 students [9]. UIC has more than 35,000 students across 16 colleges [8]. The College of Medicine holds under 4 percent of them [17].
The data loss came from inside that boundary. The spokesperson said the hackers were able to steal some information held on the college's servers [2]. An investigation is under way to determine whether "any personal, research or academic information was compromised" [5].
UIC has not said how much was taken, how the attackers got in, or how the College of Medicine's systems are administered relative to the main network [2][4]. So the public record shows where the damage landed. It does not show whether the crew picked the college because of how its systems are run. The 344 GB figure comes from Booba, which posted it when it claimed the attack last week [10].
Booba renames encrypted files with a .booba extension, and there appear to be variants for Linux as well as Windows [13]. SentinelOne's Williams drew the Frag link from the leak site's style and negotiation flow. If that link holds, Booba's 49 claims since the end of July are the work of an existing crew under a new name [11][12].
Merrimack County, one of the small county governments on Booba's list, has told local news outlets and DysruptionHub that a cyberattack hit it several weeks ago and that it has since recovered [14][15]. UIC's remaining obligation is the notice it has promised to anyone whose information was stolen [7].
What to watch
- UIC's findings on whether personal, research or academic records were in the stolen data, and when its promised notifications go out.
- Whether Booba publishes UIC files on its leak site, which would be the first outside test of the 344 GB claim.
- Code-level analysis of Booba's Linux and Windows encryptors that confirms or breaks the Frag lineage SentinelOne inferred from leak-site style.