Ransomware needs a way in. Stolen credentials are the cheapest one.
BravoX Ransomware Ransomware Group
Ransomware group profile
Description
BravoX is an emerging ransomware group that surfaced in January 2026, operating as a Ransomware-as-a-Service (RaaS) and distinguished by its sophisticated double-extortion model. It seeks to exploit high-revenue targets while avoiding attacks within the CIS countries, reflecting common practices among Russian-speaking cybercriminals.
Key insights
- •Operates as a Ransomware-as-a-Service (RaaS) with an affiliate-driven model.
- •Initial access is often gained through compromised SSL VPNs with weak passwords and no multi-factor authentication.
- •Utilizes Rclone for large-scale data exfiltration and maintains sophisticated persistence mechanisms.
- •Imposes a double-extortion model, threatening data publication if ransom demands are not met.
- •Targets high-revenue sectors across various industries, with clear pressures applied through automated data leak site features.
Threat Level & Status Breakdown
For BravoX Ransomware · Based on incidents in selected period
Status Breakdown
Recent activity
Monthly attack count for BravoX Ransomware in the selected period
No intelligence data for this group.
TTPs & Attack Vectors
Tools, initial access, and MITRE ATT&CK techniques for BravoX Ransomware
T1486
T1486
T1490
T1490
T1078
T1078
T1059
T1059
T1562
T1562
T1021.001
T1021.001
T1046
T1046
T1027
T1027
T1543
T1543
T1547
T1547
T1105
T1105
T1210
T1210
Victims(31)
| Company | Country | Status | Discovered | |
|---|---|---|---|---|
| Towill, Inc. | United States | Claimed | 1 day ago | |
| Schmidt Manufacturing | United States | Claimed | 20 days ago | |
| Moores | United Kingdom | Claimed | about 1 month ago | |
| Elettrica System | Italy | Claimed | about 1 month ago | |
| Verona 83 | Italy | Claimed | about 1 month ago | |
| Groupe Medicos | France | Claimed | about 1 month ago | |
| MITC AG | Switzerland | Claimed | about 2 months ago | |
| A&A Safety | United States | Claimed | about 2 months ago | |
| PB Fiduciaire SA | Switzerland | Claimed | 3 months ago | |
| Meta | Brazil | Claimed | 3 months ago | |
| Select Wines Merchants | Canada | Claimed | 3 months ago | |
| CCS GLOBAL TECH | United States | Claimed | 3 months ago | |
| Grupo Mauá | Brazil | Claimed | 4 months ago | |
| AcademyHealth | United States | Claimed | 4 months ago | |
| Emek Elektrik | Turkey | Claimed | 4 months ago | |
| The Salvation Army | Canada | Claimed | 4 months ago | |
| Rivadeneyra Treviño | Mexico | Claimed | 4 months ago | |
| Soprolux | France | Claimed | 5 months ago | |
| 1st Solution CTC | Germany | Claimed | 5 months ago | |
| blog | — | Claimed | 5 months ago |
Page 1 of 2
Affected countries(13)
Countries where this group has been reported to target or leak victims.