About
Aggregated threat-intel descriptionBrain Cipher emerged in July 2024. Both Windows and Linux variants are available. Brain Cipher using the leaked build of LockBit Black for their operations. The group suspected to have exploited CVE-2023-28252 (Microsoft Windows CLFS Driver Privilege Escalation Vulnerability). The Ransom demand ranges from $150,000 to $1,00,0000. Demand to be paid with Monero (XMR) cryptocurrency. In 2025, they have shifted their new Negotiation portal to new server with vanity TOR Domain starting with 'brain'.
Sectors: Business Services, Technology, Manufacturing · Countries: US, ES, FR
Recent victims
View all →| Victim | Sector | Country | Data | Posted | Status |
|---|---|---|---|---|---|
| icot.es icot.es |
Technology | ES | — | Aug 31, 2026 | countdown |
| aeiconsultants.com aeiconsultants.com |
Professional Services | US | over 55 GB. | Aug 31, 2026 | countdown |
| syc.es syc.es |
Technology | ES | over 40 GB. | Aug 31, 2026 | countdown |
| Adviesbureau De Beuckelaer BV | Professional Services | NL | over 150 GB. | Aug 31, 2026 | countdown |
| ahadandco.com ahadandco.com |
Other | AE | over 300 GB. | Aug 31, 2026 | countdown |
| sago.com sago.com |
Technology | — | Aug 31, 2026 | countdown | |
| crmeyer.com crmeyer.com |
Professional Services | DE | over 330 GB. | Aug 31, 2026 | countdown |
| ccsperfusion.com ccsperfusion.com |
Healthcare | US | over 200 GB. | Aug 31, 2026 | countdown |
| windiam.com windiam.com |
Technology | BE | over 250 GB | Jul 22, 2026 | published |
| robroy.com robroy.com |
Manufacturing | US | — | Jul 9, 2026 | published |
| iac-intl.com iac-intl.com |
Business Services | US | 1050 GB | Jul 9, 2026 | published |
| digitaldynamics.com digitaldynamics.com |
Technology | US | — | Jul 1, 2026 | published |
| goldenstateortho.com goldenstateortho.com |
Healthcare | US | more than 150 GB | Jul 1, 2026 | published |
| printronix.com | Manufacturing | US | more than 100 GB | Jul 1, 2026 | |
| paipharma.com paipharma.com |
Healthcare | BR | — | Jun 30, 2026 | published |
| eggetttax.ca eggetttax.ca |
Agriculture and Food Production | CA | over 250 GB | Jun 22, 2026 | published |
| sterlinggloballtd.com sterlinggloballtd.com |
Business Services | GB | 100gb files and documents | Jun 22, 2026 | published |
| themintgaming.com themintgaming.com |
Consumer Services | — | Jun 19, 2026 | published | |
| alu-rex.com alu-rex.com |
Manufacturing | AT | 150gb | Jun 15, 2026 | published |
| anglomoil.com anglomoil.com |
Energy | GB | — | Jun 15, 2026 | published |
| squamish.net squamish.net |
Not Found | CA | — | Jun 1, 2026 | published |
| sheppadviser.com.au sheppadviser.com.au |
Business Services | AU | 350GB | May 21, 2026 | published |
| fsbgroup.ca | Financial Services | CA | — | Oct 29, 2025 | |
| semag.fr | Technology | FR | — | Oct 29, 2025 | |
| axxia.fr | Technology | FR | — | Oct 29, 2025 |
Found by ThreatCluster
40 total from our crawlListed on this group's leak site and not present in the aggregated feeds.
robroy
robroy.com
Sep 2, 2026
liteline
liteline.com
Sep 1, 2026
nwlr
nwlr.ca
Sep 1, 2026
goldenstateortho
goldenstateortho.com
Sep 1, 2026
kisnet
kisnet.co.jp
Sep 1, 2026
eworldme
Sep 1, 2026
alu-rex
Sep 1, 2026
flbgroup.com
flbgroup.com
Sep 1, 2026
exceldor.ca
exceldor.ca
Aug 30, 2026
bridgeway-consulting.co.uk
bridgeway-consulting.co.uk
Aug 30, 2026
eworldme.com
eworldme.com
Aug 30, 2026
endeavourautomotive.co.uk
endeavourautomotive.co.uk
Aug 30, 2026
flbgroup
flbgroup.com
Aug 30, 2026
ice.org.uk
ice.org.uk
Aug 30, 2026
soundinsurance.ca
soundinsurance.ca
Aug 30, 2026
westonconsulting.com
westonconsulting.com
Aug 30, 2026
liteline.com
liteline.com · 1 files
Aug 30, 2026
nwlr.ca
nwlr.ca
Aug 30, 2026
kisnet.co.jp
kisnet.co.jp
Aug 30, 2026