Ransomware Intelligence

Ransomware needs a way in. Stolen credentials are the cheapest one.

Check Your Exposure

Brain Cipher Ransomware Ransomware Group

Ransomware group profile

49Victims
RussiaSource country
70Impact score

Description

Brain Cipher Ransomware is a financially motivated cybercriminal group known for deploying sophisticated ransomware attacks on large organizations since the early 2020s. The group employs advanced tactics such as double extortion, complete network infiltration, and data exfiltration to maximize ransom payouts. Their operations have targeted sectors including healthcare and finance, demonstrating a willingness to disrupt critical services for financial gain.

Key insights

  • Targets large organizations to maximize ransom payouts.
  • Utilizes double extortion tactics, threatening data release if ransoms are not paid.
  • Employs a modified variant of the LockBit 3.0 ransomware.
  • Engages in extensive network infiltration and data exfiltration before deployment.
  • Incorporates zero-day vulnerabilities and social engineering in their attacks.
  • Ransom demands typically range from $150,000 to $8 million, primarily paid in Monero.

Threat Level & Status Breakdown

For Brain Cipher Ransomware · Based on incidents in selected period

4.3threat level
Aggressiveness8/ 10
Lethality1.3/ 10
Criticality3.5/ 10

Status Breakdown

Data Leaked28.6%14
Claimed71.4%35
First seenOct 2025
Last seenSep 2026
Avg ransom
Payment rate
Statusactive
Sophistication0
Last updatedSep 18, 2026

Recent activity

Monthly attack count for Brain Cipher Ransomware in the selected period

49Total attacks
9peak in May
4.9avg / month
↓ 1 vs first month
OctJanFebMarAprMayJunJulAugSep036912

Intelligence

IOCs, YARA/Sigma rules, and related families for Brain Cipher Ransomware

  1. 448f1796fe8de02194b21c0715e0a5f6
  2. 71c109f3bf4da2fc0173b9bcff07e979
  3. 9c5698924d4d1881efaf88651a304cb3
  4. 41050b2b9f619cdd9916e3bdd5b9f2f9
  5. b32a8951fc4c2e4c2d63d17200ca0032
  6. f94d17b5f232e9cfd2255ca9823cb18a
  7. 8b3a45ebb7f2331e90ac57a2a20536fd
  8. 0da1f4ede654e83241eaad7719a708a0
  9. 8dbd57b042bc63b9ecdc9e3e5506ce85
  10. 714b31629c37dee57038ca4e52ef65ac
  11. a0efa7fb6dff1e035510ec1f42e083e4
  12. 523c501118ef5d7957ce54aee86d9b1d
View full IOC feed21 total

TTPs & Attack Vectors

Tools, initial access, and MITRE ATT&CK techniques for Brain Cipher Ransomware

Other

T1486

T1486

T1490

T1490

T1041

T1041

T1070

T1070

T1059

T1059

T1562

T1562

T1021

T1021

T1134

T1134

T1548.002

T1548.002

T1021.001

T1021.001

T1210

T1210

T1080

T1080

Victims(44)

United KingdomProfessional Serviceshoyletanner.com
Claimed
1 day ago
United StatesProfessional Servicesaecom.com
Claimed
1 day ago
CanadaTechnologyxpera.ca
Claimed
1 day ago
Financial Services1.outlooks
Claimed
15 days ago
Healthcareccsperfusion.com
Claimed
18 days ago
SpainTechnologyicot.es
Claimed
18 days ago
United StatesProfessional Servicesaeiconsultants.com
Claimed
18 days ago
SpainProfessional Servicessyc.es
Claimed
18 days ago
NetherlandsProfessional Services
Claimed
18 days ago
United Arab EmiratesOtherahadandco.com
Claimed
18 days ago
United StatesTechnologysago.com
Claimed
18 days ago
GermanyProfessional Servicescrmeyer.com
Claimed
18 days ago
United StatesHealthcareccsperfusion.com
Claimed
18 days ago
BelgiumTechnologywindiam.com
Claimed
about 2 months ago
United StatesManufacturingrobroy.com
Data Leaked
2 months ago
United StatesProfessional Servicesiac-intl.com
Claimed
2 months ago
United StatesTechnologydigitaldynamics.com
Data Leaked
3 months ago
United StatesHealthcaregoldenstateortho.com
Data Leaked
3 months ago
United StatesManufacturingprintronix.com
Claimed
3 months ago
BrazilHealthcarepaipharma.com
Claimed
3 months ago

Page 1 of 3