Ransomware needs a way in. Stolen credentials are the cheapest one.
brain cipher Ransomware Group
Ransomware group profile
Description
Brain Cipher Ransomware is a financially motivated cybercriminal group known for deploying sophisticated ransomware attacks on large organizations since the early 2020s. The group employs advanced tactics such as double extortion, complete network infiltration, and data exfiltration to maximize ransom payouts. Their operations have targeted sectors including healthcare and finance, demonstrating a willingness to disrupt critical services for financial gain.
Key insights
- •Targets large organizations to maximize ransom payouts.
- •Utilizes double extortion tactics, threatening data release if ransoms are not paid.
- •Employs a modified variant of the LockBit 3.0 ransomware.
- •Engages in extensive network infiltration and data exfiltration before deployment.
- •Incorporates zero-day vulnerabilities and social engineering in their attacks.
- •Ransom demands typically range from $150,000 to $8 million, primarily paid in Monero.
Threat Level & Status Breakdown
For brain cipher · Based on incidents in selected period
Status Breakdown
Recent activity
Monthly attack count for brain cipher in the selected period
Intelligence
IOCs, YARA/Sigma rules, and related families for brain cipher
- 448f1796fe8de02194b21c0715e0a5f6
- 71c109f3bf4da2fc0173b9bcff07e979
- 9c5698924d4d1881efaf88651a304cb3
- 41050b2b9f619cdd9916e3bdd5b9f2f9
- b32a8951fc4c2e4c2d63d17200ca0032
- f94d17b5f232e9cfd2255ca9823cb18a
- 8b3a45ebb7f2331e90ac57a2a20536fd
- 0da1f4ede654e83241eaad7719a708a0
- 8dbd57b042bc63b9ecdc9e3e5506ce85
- 714b31629c37dee57038ca4e52ef65ac
- a0efa7fb6dff1e035510ec1f42e083e4
- 523c501118ef5d7957ce54aee86d9b1d
TTPs & Attack Vectors
Tools, initial access, and MITRE ATT&CK techniques for brain cipher
T1486
T1486
T1490
T1490
T1041
T1041
T1070
T1070
T1059
T1059
T1562
T1562
T1021
T1021
T1134
T1134
T1548.002
T1548.002
T1021.001
T1021.001
T1210
T1210
T1080
T1080
Victims(24)
| Company | Country | Status | Discovered | |
|---|---|---|---|---|
| Robroy Industries | United States | Data Leaked | about 2 months ago | |
| Digital Dynamics | United States | Data Leaked | 2 months ago | |
| Golden State Orthopedics & Spine | United States | Data Leaked | 2 months ago | |
| PAI Pharma | Brazil | Claimed | 2 months ago | |
| Sterling Global Ltd. | United Kingdom | Data Leaked | 2 months ago | |
| The Mint Gaming Hall | United States | Claimed | 2 months ago | |
| Anglomoil | United Kingdom | Claimed | 3 months ago | |
| Alu-Rex | Austria | Data Leaked | 3 months ago | |
| Squamish Nation | Canada | Data Leaked | 3 months ago | |
| The Shepparton Adviser | Australia | Data Leaked | 3 months ago | |
| ice.org.uk | United Kingdom | Data Leaked | 4 months ago | |
| Sound Insurance Services Inc | Canada | Data Leaked | 5 months ago | |
| Endeavour Automotive | United Kingdom | Data Leaked | 5 months ago | |
| eWorld | United Arab Emirates | Data Leaked | 5 months ago | |
| Liteline | United States | Data Leaked | 6 months ago | |
| Weston Consulting | United States | Data Leaked | 6 months ago | |
| Exceldor | Canada | Data Leaked | 6 months ago | |
| FLB Group | United Kingdom | Claimed | 7 months ago | |
| KISNET Corporation | Japan | Claimed | 7 months ago | |
| North Wind Land Resources Inc. | Canada | Claimed | 7 months ago |
Page 1 of 2
Affected countries(46)
Countries where this group has been reported to target or leak victims.