Ransomware needs a way in. Stolen credentials are the cheapest one.
BravoX Ransomware Ransomware Group
Ransomware group profile
Description
BravoX is an emerging ransomware group that surfaced in January 2026, operating as a Ransomware-as-a-Service (RaaS) and distinguished by its sophisticated double-extortion model. It seeks to exploit high-revenue targets while avoiding attacks within the CIS countries, reflecting common practices among Russian-speaking cybercriminals.
Key insights
- •Operates as a Ransomware-as-a-Service (RaaS) with an affiliate-driven model.
- •Initial access is often gained through compromised SSL VPNs with weak passwords and no multi-factor authentication.
- •Utilizes Rclone for large-scale data exfiltration and maintains sophisticated persistence mechanisms.
- •Imposes a double-extortion model, threatening data publication if ransom demands are not met.
- •Targets high-revenue sectors across various industries, with clear pressures applied through automated data leak site features.
Threat Level & Status Breakdown
For BravoX Ransomware · Based on incidents in selected period
Status Breakdown
Recent activity
Monthly attack count for BravoX Ransomware in the selected period
Intelligence
IOCs, YARA/Sigma rules, and related families for BravoX Ransomware
- bravoxxtrmqeeevhl7gdh2yzvlrjxajr66d33c7ozosrccx4cz7cepad.onion
- bravoxxwcfz5qk43ychgveprpd5mw5hvxfs4a2uz2okx7mumiht4fzyd.onion
TTPs & Attack Vectors
Tools, initial access, and MITRE ATT&CK techniques for BravoX Ransomware
T1486
T1486
T1490
T1490
T1078
T1078
T1059
T1059
T1562
T1562
T1021.001
T1021.001
T1046
T1046
T1027
T1027
T1543
T1543
T1547
T1547
T1105
T1105
T1210
T1210
Affected countries(13)
Countries where this group has been reported to target or leak victims.