Ransomware needs a way in. Stolen credentials are the cheapest one.
BravoX Ransomware Ransomware Group
Ransomware group profile
Description
BravoX is an emerging ransomware group that surfaced in January 2026, operating as a Ransomware-as-a-Service (RaaS) and distinguished by its sophisticated double-extortion model. It seeks to exploit high-revenue targets while avoiding attacks within the CIS countries, reflecting common practices among Russian-speaking cybercriminals.
Key insights
- •Operates as a Ransomware-as-a-Service (RaaS) with an affiliate-driven model.
- •Initial access is often gained through compromised SSL VPNs with weak passwords and no multi-factor authentication.
- •Utilizes Rclone for large-scale data exfiltration and maintains sophisticated persistence mechanisms.
- •Imposes a double-extortion model, threatening data publication if ransom demands are not met.
- •Targets high-revenue sectors across various industries, with clear pressures applied through automated data leak site features.
Threat Level & Status Breakdown
For BravoX Ransomware · Based on incidents in selected period
Status Breakdown
Recent activity
Monthly attack count for BravoX Ransomware in the selected period
No intelligence data for this group.
TTPs & Attack Vectors
Tools, initial access, and MITRE ATT&CK techniques for BravoX Ransomware
T1486
T1486
T1490
T1490
T1078
T1078
T1059
T1059
T1562
T1562
T1021.001
T1021.001
T1046
T1046
T1027
T1027
T1543
T1543
T1547
T1547
T1105
T1105
T1210
T1210
Victims(5)
| Company | Country | Status | Discovered | |
|---|---|---|---|---|
| Moores | United Kingdom | Claimed | 13 days ago | |
| Elettrica System | Italy | Claimed | 19 days ago | |
| Verona 83 | Italy | Claimed | 20 days ago | |
| Groupe Medicos | France | Claimed | 22 days ago | |
| MITC AG | Switzerland | Claimed | 24 days ago |
Affected countries(13)
Countries where this group has been reported to target or leak victims.