MITC AG Data Breach

MITC AG, a Swiss-registered organization not typically falling into standard commercial verticals, has been listed as a victim on the Bravox ransomware group’s dark web portal. This listing, published on August 6, 2026, was identified by SOCRadar’s Dark Web Monitoring service. The company manages its own mail and remote-access infrastructure using its primary domain, suggesting a self-managed IT environment rather than one fully outsourced. The Bravox portal has historically shown very low activity, with MITC AG being one of only a few entries. In the 60 days preceding this listing, Bravox claimed two other victims. The group’s targeting pattern has included the “Other” and “Financial Services” sectors, with a concentration of victims in Switzerland and the United States. Recent Bravox victims that share similarities with MITC AG, such as being Swiss organizations or in the same broad sector category, include A&A Safety and PB Fiduciaire SA. Given the low number of three listings in this period, a definitive targeting pattern is difficult to establish. However, the fact that two of these three victims are Swiss might indicate a regional source for initial access rather than a specific strategic focus by the ransomware group.

SOCRadar’s analysis of stealer-log telemetry revealed a significant credential exposure related to the mitc.ch domain. The queried sample contained eleven records in total. Five of these records were employee credentials for organization-owned systems, one was a third-party user credential on these systems, and three were corporate identities for external services. Critical endpoints identified included the company’s mail server and a remote-access portal operating on a non-standard port, with the latter being accessed as recently as mid-July 2026. A single corporate identity was associated with eight of the eleven records, appearing across both internal infrastructure and external consumer services, suggesting a heavily compromised workstation or account. The retrieved records show a freshness range from February 10, 2026, to July 13, 2026, with long-tail persistence and a mixed credential profile. For ransomware groups like Bravox, credentials harvested by infostealers represent a well-documented vector for initial access. Threat actors or initial access brokers often acquire fresh logs from underground marketplaces, validate the corporate credentials, and then use them to access systems such as Microsoft 365, VPNs, or remote-access portals before deploying ransomware. While the stealer-log evidence identified in this instance does not definitively confirm that these specific credentials were used by Bravox, the presence of an exposed remote-access portal coupled with unrotated mail credentials presents a typical scenario for this kill chain. Threat intelligence teams should prioritize credential rotation and a review of remote-access logs as proactive measures, rather than waiting for direct confirmation of exploitation.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.