Braincipher
| Active
Brain Cipher emerged in July 2024. Both Windows and Linux variants are available. Brain Cipher using the leaked build of LockBit Black for their operations. The group suspected to have exploited CVE-2023-28252 (Microsoft Windows CLFS Driver Privilege Escalation Vulnerability). The Ransom demand ranges from $150,000 to $1,00,0000. Demand to be paid with Monero (XMR) cryptocurrency. In 2025, they have shifted their new Negotiation portal to new server with vanity TOR Domain starting with 'brain'.
Victims
69
First Victim
2024-07-01
(est. attack date)
Discovery Date
2024-07-01
Last Seen
2026-07-22
Inactive Since
31
days
Avg Delay
43.5
days
Infostealer
40.6%
victims with domain
Countries
25
hit
Uptime
96.1% avg (30d)
Attack Velocity — Last 12 months (based on attack estimated date if available)
Known Locations (8)
| Favicon | Title | Type | Available | Last Visit | Server Info | FQDN | Status | |
|---|---|---|---|---|---|---|---|---|
|
Brain Cipher Dataleak | Yes | 2026-08-22T10:43:06 |
vkvsgl7lhipjirmz6j5ubp3w3bwvxgcdbpi3fsbqngfynetqtw4w5hyd.onion
|
||||
|
Brain Cipher Client Area | No | 2026-08-22T08:14:23 |
mybmtbgd7aprdnw2ekxht5qap5daam2wch25coqerrq2zdioanob34ad.onion
|
||||
|
BrainCipher Client Area | No | 2026-08-22T08:14:36 |
brain4zoadgr6clxecixffvxjsw43cflyprnpfeak72nfh664kqqriyd.onion
|
||||
|
BrainCipher Client Area | No | 2026-08-22T08:15:46 |
77nrxelcwh47yikvpaz2rvtsten4sen2elybo5r5st6wlxsbitv255qd.onion
|
||||
|
BrainCipher Client Area | No | 2026-08-22T08:16:51 |
p6wmotxzvg34tdmpwm4beqgrcyp5iys43snkccsahnw74la3k3xx6pad.onion
|
||||
|
BrainCipher Storage | No | 2026-08-22T08:12:39 |
zktnif5vckhmz5tyrukp5bamatbfhkxjnb23rspsanyzywcrx3bvtqad.onion
|
||||
|
Not Found | No | 2026-08-22T08:12:52 |
4ldgw2wuidqu5ef3rzx4byonf3y7rdnh43jiw2z4sbtjiwic6gkov7yd.onion
|
||||
|
BrainCipher Storage | No | 2026-08-22T08:14:06 |
cuuhrxbg52c5agytmtjpwfu7mrs4xtaitc4mukkiy2kqdxeqbcmuhaid.onion
|
Target
Top 5 Activity Sectors
- Professional Services 20
- Technology 11
- Manufacturing 10
- Healthcare 5
- Retail & E-Commerce 4
Top 5 Countries
-
United States
19
-
Canada
7
-
United Kingdom
7
-
France
5
-
Mexico
4
Heatmap
Ransom Notes (3)
TTPs Matrix (4)
| Execution | Defense Evasion | Discovery | Impact |
|---|---|---|---|
| User Execution | Indicator Removal: File Deletion | File and Directory Discovery | Data Encrypted for Impact |
| Impair Defenses: Disable or Modify Tools |
YARA Rules (1)
Indicators of Compromise (IoCs) (16)
Email
4
Hash MD5
12
Victims (69)
[AI generated] Rob Roy Industries, operating through robroy.com, is a US-based manufacturer speciali…
[AI generated] Golden State Ortho appears to be an orthopedic medical practice or orthopedic supply …
[AI generated] Printronix is a US-based company specializing in industrial printing solutions. Found…
[AI generated] Alu-Rex is a Canadian company specializing in the manufacturing of gutter protection …
[AI generated] Anglomoil is an Australian company specialising in the manufacture and supply of lubr…
[AI generated] squamish.net appears to be an internet service provider and telecommunications compan…
[AI generated] ICE, the Institution of Civil Engineers, is a UK-based professional membership organi…
[AI generated] Kisnet Co., Ltd. is a Japanese internet service provider based in Japan. The company …
[AI generated] Liteline is a Canadian lighting manufacturer and distributor based in Ontario, Canada…
[AI generated] Exceldor is a Canadian agricultural cooperative specializing in poultry production an…
[AI generated] Endeavour Automotive is a UK-based car dealership group operating across England. The…
[AI generated] Oxford County represents the best of both worlds: urban communities full of life, ent…
[AI generated] "Jorgefernandez.es" is a Spain-based company engaged in the distribution of home impr…
[AI generated] D'Decor is a leading home decor company known for its innovative and stylish range of…
[AI generated] Ruizre.es is a real estate company based in Valencia, Spain that specializes in prope…
[AI generated] Sound Transit, operating under the domain "soundtransit.org", is a mass transit agenc…
[AI generated] "Valedolobo.com" is the online platform for the Vale do Lobo resort located in Portug…
[AI generated] Edisoft is a Spanish technological company specializing in development and implementa…
Provides support and resources for health, financial aid, and social services in Rhode Island.…
[AI generated] Modern Dental Group Limited is a global dental service provider headquartered in Hong…
[AI generated] Estar Seguros, S.A. is an insurance company that specializes in providing a range of …
[AI generated] Cristal y Lavisa S.A. de C.V. is a Mexican company specializing in the production and…
[AI generated] Deloitte UK is a leading professional services firm, part of the global Deloitte netw…
[AI generated] Royce Corporation is a global trading company specializing in the distribution and ma…
[AI generated] G-ONE Auto Parts de México, S.A. de C.V. is a company based in Mexico specializing in…
[AI generated] COOPERATIVA TELEFONICA DE CALAFATE LTD. is a telecommunications cooperative based in …
[AI generated] G-One Auto Parts de México S.A. de C.V. is a Mexican company specializing in the dist…
[IA generated] Berridge Manufacturing Co. specializes in the production of high-quality metal roofin…
[IA generated] K&S Tool & Mfg Co. is a company specializing in precision manufacturing and tooling s…
[IA generated] Basilio Advogados is a prominent law firm based in Brazil, known for its expertise in…
[IA generated] CHRISTODOULOS G. VASSILIADES & CO. LLC is a prominent law firm based in Cyprus, speci…
Hanwa Co., Ltd. (Thailand) is a subsidiary of Hanwa Co., Ltd., a Japan-based global trading company.…
Réunion des Musées Nationaux-Grand Palais (RMN-GP) is a French cultural institution dedicated to man…
Ghanare.com is an online platform dedicated to providing comprehensive real estate services in Ghana…
Prof. Bein & Co., accessible via beinlaw.co.il, is a reputable law firm based in Israel. It speciali…
Tiendasmacuto.com is an online retail store specializing in outdoor and adventure gear. They offer a…
