Ransomware Intelligence

Ransomware needs a way in. Stolen credentials are the cheapest one.

Check Your Exposure

Brain Cipher Ransomware Ransomware Group

Ransomware group profile

60Victims
RussiaSource country
70Impact score

Description

Brain Cipher Ransomware is a financially motivated cybercriminal group known for deploying sophisticated ransomware attacks on large organizations since the early 2020s. The group employs advanced tactics such as double extortion, complete network infiltration, and data exfiltration to maximize ransom payouts. Their operations have targeted sectors including healthcare and finance, demonstrating a willingness to disrupt critical services for financial gain.

Key insights

  • •Targets large organizations to maximize ransom payouts.
  • •Utilizes double extortion tactics, threatening data release if ransoms are not paid.
  • •Employs a modified variant of the LockBit 3.0 ransomware.
  • •Engages in extensive network infiltration and data exfiltration before deployment.
  • •Incorporates zero-day vulnerabilities and social engineering in their attacks.
  • •Ransom demands typically range from $150,000 to $8 million, primarily paid in Monero.

Threat Level & Status Breakdown

For Brain Cipher Ransomware · Based on incidents in selected period

3.1threat level
Aggressiveness5/ 10
Lethality1/ 10
Criticality3.4/ 10

Status Breakdown

Data Leaked23.3%14
Claimed76.7%46
First seenOct 2025
Last seenSep 2026
Avg ransom—
Payment rate—
Statusactive
Sophistication0
Last updatedOct 8, 2026

Recent activity

Monthly attack count for Brain Cipher Ransomware in the selected period

60Total attacks
15peak in Sep
6avg / month
↑ 10 vs first month
OctJanFebMarAprMayJunJulAugSep0481216

Intelligence

IOCs, YARA/Sigma rules, and related families for Brain Cipher Ransomware

  1. 448f1796fe8de02194b21c0715e0a5f6
  2. 71c109f3bf4da2fc0173b9bcff07e979
  3. 9c5698924d4d1881efaf88651a304cb3
  4. 41050b2b9f619cdd9916e3bdd5b9f2f9
  5. b32a8951fc4c2e4c2d63d17200ca0032
  6. f94d17b5f232e9cfd2255ca9823cb18a
  7. 8b3a45ebb7f2331e90ac57a2a20536fd
  8. 0da1f4ede654e83241eaad7719a708a0
  9. 8dbd57b042bc63b9ecdc9e3e5506ce85
  10. 714b31629c37dee57038ca4e52ef65ac
  11. a0efa7fb6dff1e035510ec1f42e083e4
  12. 523c501118ef5d7957ce54aee86d9b1d
View full IOC feed21 total

TTPs & Attack Vectors

Tools, initial access, and MITRE ATT&CK techniques for Brain Cipher Ransomware

Other

T1486

T1486

T1490

T1490

T1041

T1041

T1070

T1070

T1059

T1059

T1562

T1562

T1021

T1021

T1134

T1134

T1548.002

T1548.002

T1021.001

T1021.001

T1210

T1210

T1080

T1080

Victims(55)

GeorgiaTransportationgoriteway.com
Claimed
10 days ago
Healthcarenortheastrehab.com
Claimed
10 days ago
United StatesManufacturinglatitudesubro.com
Claimed
10 days ago
United StatesTransportationtrailerbridge.com
Claimed
10 days ago
United StatesFinancial Servicesmccordclaims.com
Claimed
10 days ago
GeorgiaTransportationgoriteway.com
Claimed
10 days ago
United StatesHealthcarenortheastrehab.com
Claimed
10 days ago
United StatesEnergy & Utilitiesmulholland.com
Claimed
10 days ago
BulgariaOtherwildmanbg.com
Claimed
10 days ago
United KingdomOthermaxwell-group.com
Claimed
10 days ago
United StatesFinancial Servicesgoldstarfinancial.com
Claimed
16 days ago
United KingdomProfessional Serviceshoyletanner.com
Claimed
22 days ago
United StatesProfessional Servicesaecom.com
Claimed
22 days ago
CanadaTechnologyxpera.ca
Claimed
22 days ago
Financial Services1.outlooks
Claimed
about 1 month ago
Healthcareccsperfusion.com
Claimed
about 1 month ago
SpainTechnologyicot.es
Claimed
about 1 month ago
United StatesProfessional Servicesaeiconsultants.com
Claimed
about 1 month ago
SpainProfessional Servicessyc.es
Claimed
about 1 month ago
NetherlandsProfessional Services
Claimed
about 1 month ago

Page 1 of 3