Ransomware group
Bravox ransomware: victims and leak site activity
The Bravox ransomware group has listed 34 victims on its leak site since February 2026; its latest post is from 22 October 2026. Most affected countries: United States, France and Switzerland. Most targeted sector: Healthcare.
Total posts
34
First seen
2026-02-11
Latest post
2026-10-22
Countries hit
11
About Bravox
BravoX is a selective ransomware-as-a-service operation that surfaced publicly in January 2026 after advertising on the RAMP underground forum, targeting primarily US-based organizations in healthcare and retail while applying strict affiliate vetting requirements including proof of access or a financial deposit.
- Leak site (Tor)
- http://bravoxxtrmqeeevhl7gdh2yzvlrjxajr66d33c7ozosrccx4cz7cepad.onion
- Profile
- ransomware.live
Most targeted countries
- United States 11
- France 5
- Switzerland 4
- Canada 3
- Brazil 2
- Germany 2
- United Kingdom 2
- Italy 2
- Mexico 1
- Malaysia 1
Most targeted sectors
- Healthcare 5
- Technology 5
- Professional Services 4
- Financial Services 3
- Agriculture and Food Production 2
- Energy & Utilities 2
- Manufacturing 2
- Retail & E-Commerce 2