Ransomware group
BrainCipher ransomware: victims and leak site activity
The BrainCipher ransomware group has listed 98 victims on its leak site since July 2024; its latest post is from 21 October 2026. Most affected countries: United States, United Kingdom and Canada. Most targeted sector: Professional Services.
About BrainCipher
Brain Cipher emerged in July 2024. Both Windows and Linux variants are available. Brain Cipher using the leaked build of LockBit Black for their operations. The group suspected to have exploited CVE-2023-28252 (Microsoft Windows CLFS Driver Privilege Escalation Vulnerability). The Ransom demand ranges from $150,000 to $1,00,0000. Demand to be paid with Monero (XMR) cryptocurrency. In 2025, they have shifted their new Negotiation portal to new server with vanity TOR Domain starting with 'brain'.
- Leak site (Tor)
- http://vkvsgl7lhipjirmz6j5ubp3w3bwvxgcdbpi3fsbqngfynetqtw4w5hyd.onion
- Profile
- ransomware.live
Most targeted countries
- United States 33
- United Kingdom 10
- Canada 8
- Spain 5
- France 5
- Mexico 4
- United Arab Emirates 3
- Argentina 3
- Brazil 3
- Germany 2
Most targeted sectors
- Professional Services 28
- Technology 15
- Manufacturing 11
- Healthcare 10
- Financial Services 6
- Retail & E-Commerce 4
- Agriculture and Food Production 3
- Government & Defense 3
- Transportation 3
- Education 2