Loading threat actor…
Frag is a ransomware operation first observed in 2024 and associated with double-extortion activity. It has been publicly linked to exploitation of Veeam Backup & Replication remote code execution vulnerabilities, particularly CVE-2024-40711, to gain access and deploy ransomware. Reporting also places Frag among ransomware groups that target backup infrastructure to steal data, move laterally, and impair recovery by deleting or compromising backups. The group has been described as targeting industrial sectors and has been connected through shared cryptocurrency laundering infrastructure to the Akira and Fog ransomware ecosystems. Booba Team has been assessed as a likely rebrand of Frag. Known aliases include frag_ransomware_operators and the suspected successor or rebrand Booba Team.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
5 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Earlier ransomware group referenced as the predecessor identity for Booba Team.
Associated with exploitation of Veeam Backup & Replication vulnerabilities in ransomware operations.
Named as one of several ransomware operations weaponizing a critical Veeam Backup & Replication RCE flaw in attacks.
Referenced as a ransomware group operationally linked to Akira through shared laundering infrastructure.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.