BrainCipher
First seen July 1, 2024Active99 claimed victims
The claims below are reproduced as posted by BrainCipher on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Brain Cipher emerged in July 2024. Both Windows and Linux variants are available. Brain Cipher using the leaked build of LockBit Black for their operations. The group suspected to have exploited CVE-2023-28252 (Microsoft Windows CLFS Driver Privilege Escalation Vulnerability). The Ransom demand ranges from $150,000 to $1,00,0000. Demand to be paid with Monero (XMR) cryptocurrency. In 2025, they have shifted their new Negotiation portal to new server with vanity TOR Domain starting with 'brain'.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| mvjllp.com | October 21, 2026 | ransomware_live | — |
| olyortho.com | October 21, 2026 | ransomware_live | — |
| prosomnus.com | October 21, 2026 | ransomware_live | — |
| srsnodgrass.com | October 21, 2026 | ransomware_live | — |
| sodali.com | October 21, 2026 | ransomware_live | — |
| clinicaromero.com | October 21, 2026 | ransomware_live | — |
| oflaherty-law.com | October 21, 2026 | ransomware_live | — |
| novagroupgbc.com | October 21, 2026 | ransomware_live | — |
| huntcompanies.com | October 11, 2026 | ransomware_live | — |
| maxwell-group.com | September 29, 2026 | ransomware_live | — |
| wildmanbg.com | September 29, 2026 | ransomware_live | — |
| mulholland.com | September 29, 2026 | ransomware_live | — |
| northeastrehab.com | September 29, 2026 | ransomware_live | — |
| goriteway.com | September 29, 2026 | ransomware_live | — |
| mccordclaims.com | September 29, 2026 | ransomware_live | — |
| trailerbridge.com | September 29, 2026 | ransomware_live | — |
| latitudesubro.com | September 29, 2026 | ransomware_live | — |
| goldstarfinancial.com | September 23, 2026 | ransomware_live | — |
| xpera.ca | September 17, 2026 | ransomware_live | — |
| aecom.com | September 17, 2026 | ransomware_live | — |
| hoyletanner.com | September 17, 2026 | ransomware_live | — |
| ccsperfusion.com | August 31, 2026 | ransomware_live | — |
| crmeyer.com | August 31, 2026 | ransomware_live | — |
| sago.com | August 31, 2026 | ransomware_live | — |
| ahadandco.com | August 31, 2026 | ransomware_live | — |
| Adviesbureau De Beuckelaer BV | August 31, 2026 | ransomware_live | — |
| syc.es | August 31, 2026 | ransomware_live | — |
| aeiconsultants.com | August 31, 2026 | ransomware_live | — |
| icot.es | August 31, 2026 | ransomware_live | — |
| windiam.com | July 22, 2026 | ransomware_live | — |
| iac-intl.com | July 9, 2026 | ransomware_live | — |
| robroy.com | July 9, 2026 | ransomware_live | — |
| printronix.com | July 1, 2026 | ransomware_live | — |
| goldenstateortho.com | July 1, 2026 | ransomware_live | — |
| digitaldynamics.com | July 1, 2026 | ransomware_live | — |
| paipharma.com | June 30, 2026 | ransomware_live | — |
| sterlinggloballtd.com | June 22, 2026 | ransomware_live | — |
| eggetttax.ca | June 22, 2026 | ransomware_live | — |
| themintgaming.com | June 19, 2026 | ransomware_live | — |
| anglomoil.com | June 15, 2026 | ransomware_live | — |
| alu-rex.com | June 15, 2026 | ransomware_live | — |
| paipharma.com | June 13, 2026 | ransomware_live | — |
| squamish.net | June 1, 2026 | ransomware_live | — |
| sheppadviser.com.au | May 21, 2026 | ransomware_live | — |
| ice.org.uk | May 11, 2026 | ransomware_live | — |
| bridgeway-consulting.co.uk | May 1, 2026 | ransomware_live | — |
| eworldme.com | May 1, 2026 | ransomware_live | — |
| endeavourautomotive.co.uk | May 1, 2026 | ransomware_live | — |
| soundinsurance.ca | May 1, 2026 | ransomware_live | — |
| exceldor.ca | May 1, 2026 | ransomware_live | — |
| westonconsulting.com | May 1, 2026 | ransomware_live | — |
| liteline.com | May 1, 2026 | ransomware_live | — |
| nwlr.ca | May 1, 2026 | ransomware_live | — |
| kisnet.co.jp | May 1, 2026 | ransomware_live | — |
| flbgroup.com | May 1, 2026 | ransomware_live | — |
| axxia.fr | October 29, 2025 | ransomware_live | — |
| semag.fr | October 29, 2025 | ransomware_live | — |
| fsbgroup.ca | October 29, 2025 | ransomware_live | — |
| cdom.org | October 20, 2025 | ransomware_live | — |
| oxfordcounty.ca | October 20, 2025 | ransomware_live | — |
| bmsi.org | September 16, 2025 | ransomware_live | — |
| bw-lv.de | August 4, 2025 | ransomware_live | — |
| VIRTUALWEB.US | July 28, 2025 | ransomware_live | — |
| jorgefernandez.es | July 25, 2025 | ransomware_live | — |
| iycsa.com.co | May 5, 2025 | ransomware_live | — |
| edisoft.es | May 5, 2025 | ransomware_live | — |
| valedolobo.com | May 5, 2025 | ransomware_live | — |
| soundtransit.org | May 5, 2025 | ransomware_live | — |
| ruizre.es | May 5, 2025 | ransomware_live | — |
| ddecor.com | May 5, 2025 | ransomware_live | — |
| mbmdubai.com | May 5, 2025 | ransomware_live | — |
| Pulmonary Physicians of South Florida Clinics | May 5, 2025 | ransomware_live | — |
| neatem.fr | February 17, 2025 | ransomware_live | — |
| Modern Dental Group Limited | December 18, 2024 | ransomware_live | — |
| Rhode Island Department of Humain Services | December 13, 2024 | ransomware_live | — |
| Cristal y Lavisa S.A. de C.V. | December 12, 2024 | ransomware_live | — |
| Estar Seguros, S.A. | December 12, 2024 | ransomware_live | — |
| Deloitte UK | December 4, 2024 | ransomware_live | — |
| Royce Corporation | December 3, 2024 | ransomware_live | — |
| G-ONE AUTO PARTS DE MÉXICO, S.A. DE C.V. | December 2, 2024 | ransomware_live | — |
| G-One Auto Parts de México S.A. de C.V. | November 13, 2024 | ransomware_live | — |
| COOPERATIVA TELEFONICA DE CALAFATE LTD. | November 13, 2024 | ransomware_live | — |
| Berridge Manufacturing Co. | October 29, 2024 | ransomware_live | — |
| CHRISTODOULOS G. VASSILIADES & CO. LLC | October 28, 2024 | ransomware_live | — |
| Basilio Advogados | October 28, 2024 | ransomware_live | — |
| K&S Tool & Mfg Co. | October 28, 2024 | ransomware_live | — |
| hanwa.co.th | September 22, 2024 | ransomware_live | — |
| rmn.fr | August 29, 2024 | ransomware_live | — |
| ghanare.com | August 28, 2024 | ransomware_live | — |
| beinlaw.co.il - Prof. Bein & Co. | August 21, 2024 | ransomware_live | — |
| tiendasmacuto.com | August 17, 2024 | ransomware_live | — |
| cyceron.fr | August 12, 2024 | ransomware_live | — |
| fabamaq.com | August 12, 2024 | ransomware_live | — |
| Mars 2 LLC | July 21, 2024 | ransomware_live | — |
| Family Wealth Advisors Ltd. | July 21, 2024 | ransomware_live | — |
| Cole Technologies Group | July 21, 2024 | ransomware_live | — |
| Apex Global | Big leak outlooks - 2tb. | July 21, 2024 | ransomware_live | — |
| Sherbrooke Metals | July 21, 2024 | ransomware_live | — |
| Indonesia Terkoneksi | July 1, 2024 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).