🏹 BrainCipher — Ransomware
Brain Cipher emerged in July 2024. Both Windows and Linux variants are available. Brain Cipher using the leaked build of LockBit Black for their operations. The group suspected to have exploited CVE-2023-28252 (Microsoft Windows CLFS Driver Privilege Escalation Vulnerability). The Ransom demand ranges from $150,000 to $1,00,0000. Demand to be paid with Monero (XMR) cryptocurrency. In 2025, they have shifted their new Negotiation portal to new server with vanity TOR Domain starting with 'brain'.
Classification
Ransomware
Leak-site victims
69
Ransomware.live
Associated IoCs
0
local intel
MITRE techniques
—
ATT&CK
Tracked
Yes
Ransomware.live
🔥 Leak-Site Victims (69)
| Victim | Country | Published | Domain |
|---|---|---|---|
| windiam.com | BE | 2026-07-22T17:20:37.495782+00:00 | windiam.com |
| robroy.com | US | 2026-07-09T15:21:13.208414+00:00 | robroy.com |
| iac-intl.com | US | 2026-07-09T15:20:35.183236+00:00 | iac-intl.com |
| digitaldynamics.com | US | 2026-07-01T15:51:52.782912+00:00 | digitaldynamics.com |
| goldenstateortho.com | US | 2026-07-01T15:51:11.297961+00:00 | goldenstateortho.com |
| printronix.com | US | 2026-07-01T15:50:32.498123+00:00 | printronix.com |
| paipharma.com | BR | 2026-06-30T16:50:32.430072+00:00 | paipharma.com |
| eggetttax.ca | CA | 2026-06-22T19:50:47.320389+00:00 | eggetttax.ca |
| sterlinggloballtd.com | GB | 2026-06-22T19:20:25.356137+00:00 | sterlinggloballtd.com |
| themintgaming.com | 2026-06-19T21:20:31.919662+00:00 | themintgaming.com | |
| alu-rex.com | AT | 2026-06-15T18:20:34.560204+00:00 | alu-rex.com |
| anglomoil.com | GB | 2026-06-15T17:50:26.631594+00:00 | anglomoil.com |
| squamish.net | CA | 2026-06-01T15:20:25.797090+00:00 | squamish.net |
| sheppadviser.com.au | AU | 2026-05-21T15:50:23.972795+00:00 | sheppadviser.com.au |
| ice.org.uk | GB | 2026-05-11T16:20:27.426306+00:00 | ice.org.uk |
| flbgroup.com | GB | 2026-05-01T09:57:18.147758+00:00 | flbgroup.com |
| kisnet.co.jp | JP | 2026-05-01T09:57:02.880050+00:00 | kisnet.co.jp |
| nwlr.ca | CA | 2026-05-01T09:56:43.889622+00:00 | nwlr.ca |
| liteline.com | US | 2026-05-01T09:56:29.534001+00:00 | liteline.com |
| westonconsulting.com | US | 2026-05-01T09:56:12.850193+00:00 | westonconsulting.com |
| exceldor.ca | CA | 2026-05-01T09:55:56.654991+00:00 | exceldor.ca |
| soundinsurance.ca | CA | 2026-05-01T09:55:40.523929+00:00 | soundinsurance.ca |
| endeavourautomotive.co.uk | GB | 2026-05-01T09:55:24.470275+00:00 | endeavourautomotive.co.uk |
| eworldme.com | AE | 2026-05-01T09:55:08.624272+00:00 | eworldme.com |
| bridgeway-consulting.co.uk | GB | 2026-05-01T09:54:53.854465+00:00 | bridgeway-consulting.co.uk |
| fsbgroup.ca | CA | 2025-10-29T21:37:52.388072+00:00 | fsbgroup.ca |
| semag.fr | FR | 2025-10-29T21:37:10.608015+00:00 | semag.fr |
| axxia.fr | FR | 2025-10-29T21:36:28.904825+00:00 | axxia.fr |
| cdom.org | US | 2025-10-20T18:05:36.941768+00:00 | cdom.org |
| oxfordcounty.ca | CA | 2025-10-20T18:06:07.549022+00:00 | oxfordcounty.ca |
| bw-lv.de | DE | 2025-08-04T16:08:39.035159+00:00 | bw-lv.de |
| VIRTUALWEB.US | US | 2025-07-28T21:05:44.322380+00:00 | VIRTUALWEB.US |
| jorgefernandez.es | ES | 2025-07-25T19:48:15.338441+00:00 | jorgefernandez.es |
| bmsi.org | US | 2025-09-16T17:17:34.229410+00:00 | bmsi.org |
| Pulmonary Physicians of South Florida Clinics | US | 2025-05-05T10:39:32.527884+00:00 | pulmonaryphysiciansfla.com |
| mbmdubai.com | AE | 2025-05-05T10:35:36.088779+00:00 | mbmdubai.com |
| ddecor.com | IN | 2025-05-05T10:33:32.465700+00:00 | ddecor.com |
| ruizre.es | ES | 2025-05-05T10:31:21.459301+00:00 | ruizre.es |
| soundtransit.org | US | 2025-05-05T10:29:51.790709+00:00 | soundtransit.org |
| valedolobo.com | PT | 2025-05-05T10:27:40.160664+00:00 | valedolobo.com |
| edisoft.es | ES | 2025-05-05T10:25:33.146007+00:00 | edisoft.es |
| iycsa.com.co | CO | 2025-05-05T10:23:04.518082+00:00 | iycsa.com.co |
| neatem.fr | FR | 2025-05-05T10:37:20.480255+00:00 | neatem.fr |
| Modern Dental Group Limited | HK | 2024-12-18T08:39:10.188148+00:00 | moderndentalgp.com |
| Rhode Island Department of Humain Services | US | 2024-12-23T14:32:20.588723+00:00 | dhs.ri.gov |
| Estar Seguros, S.A. | MX | 2024-12-12T09:56:03.808730+00:00 | estarseguros.com |
| Cristal y Lavisa S.A. de C.V. | MX | 2024-12-12T09:54:57.200314+00:00 | cristalylavisa.com.mx |
| Deloitte UK | GB | 2024-12-04T14:35:20.807032+00:00 | deloitte.co.uk |
| Royce Corporation | US | 2024-12-03T15:05:52.752522+00:00 | roycecorporation.com |
| G-ONE AUTO PARTS DE MÉXICO, S.A. DE C.V. | MX | 2024-12-02T17:15:47.179877+00:00 | g-one.com.mx |
| COOPERATIVA TELEFONICA DE CALAFATE LTD. | AR | 2024-11-13T16:40:55.145591+00:00 | cotecal.com.ar |
| G-One Auto Parts de México S.A. de C.V. | MX | 2024-11-13T16:39:45.176909+00:00 | g-one.com.mx |
| Berridge Manufacturing Co. | US | 2024-10-29T10:14:33.053623+00:00 | berridge.com |
| K&S Tool & Mfg Co. | US | 2024-10-28T22:11:19.494880+00:00 | ks-tool.com |
| Basilio Advogados | BR | 2024-10-28T22:10:10.654219+00:00 | basilioadvogados.com.br |
| CHRISTODOULOS G. VASSILIADES & CO. LLC | CY | 2024-10-28T22:09:01.328010+00:00 | vasslaw.com |
| hanwa.co.th | TH | 2024-09-22T22:05:31.934092+00:00 | hanwa.co.th |
| ghanare.com | GH | 2024-08-28T19:10:01.316165+00:00 | ghanare.com |
| beinlaw.co.il - Prof. Bein & Co. | IL | 2024-08-21T21:42:46.853420+00:00 | beinlaw.co.il |
| tiendasmacuto.com | VE | 2024-08-17T18:56:50.839918+00:00 | tiendasmacuto.com |
| fabamaq.com | AR | 2024-08-12T23:02:42.241256+00:00 | fabamaq.com |
| cyceron.fr | FR | 2024-08-12T22:59:22.476918+00:00 | cyceron.fr |
| rmn.fr | FR | 2024-08-29T01:13:43.067319+00:00 | rmn.fr |
| Sherbrooke Metals | US | 2024-07-21T19:23:38.174032+00:00 | sherbrookemetals.com |
| Apex Global | Big leak outlooks - 2tb. | NL | 2024-07-21T19:22:52.231178+00:00 | apexglobal.eu |
| Cole Technologies Group | US | 2024-07-21T19:22:10.555420+00:00 | coletg.com |
| Family Wealth Advisors Ltd. | IL | 2024-07-21T19:21:28.400965+00:00 | fwa.co.il |
| Mars 2 LLC | US | 2024-07-21T19:20:41.473247+00:00 | marslc.com |
| Indonesia Terkoneksi | ID | 2024-07-01T19:10:39+00:00 | kominfo.go.id |
Source: Ransomware.live leak-site monitoring (cached, offline-safe).
📁 Case Management
🏹 Campaigns & malware
🏹 Add to case
🧩 Advanced Capabilities
Live group profile & victims via Ransomware.live; ATT&CK technique hints are a static reference for well-known groups. All network calls cached & offline-safe.
Workstation · Copilot · AI Skills · Automation · Playbooks · Lookups · Docs · Reports
🤖 AI Copilot
⚡ AI Skills
🔍 Lookup & Enrich
📚 Docs & Reports
💡 Recommendations
- Explore related tools below
- Automate recurring work via cron