// THREAT ACTOR
BRAIN-CIPHER_
ActiveBRAIN-CIPHER is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem — file encryption combined with the threat of stolen-data publication on a public leak site — and continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of BRAIN-CIPHER — incident write-ups, attribution notes, and additional context — see the Threat Groups archive or run a site search.
73
Victims tracked
13 / 39
Active mirrors
2024-07-02
First listing
2026-07-22
Most recent
Victims by year
- 2026 25
- 2025 20
- 2024 28
Leak site mirrors
39 mirrors tracked, 13 currently reachable. These are criminal-infrastructure URLs — links are deliberately not provided.
-
mybmtbgd7aprdnw2ekxht5qap5daam2wch25coqerrq2zdioanob34ad.onionBrain Cipher Client Area snapshot · 2024-07-07 15:04 -
vkvsgl7lhipjirmz6j5ubp3w3bwvxgcdbpi3fsbqngfynetqtw4w5hyd.onionBrain Cipher Dataleak snapshot · 2026-08-06 21:37 -
cuuhrxbg52c5agytmtjpwfu7mrs4xtaitc4mukkiy2kqdxeqbcmuhaid.onionsnapshot · 2024-12-11 12:22 -
p6wmotxzvg34tdmpwm4beqgrcyp5iys43snkccsahnw74la3k3xx6pad.onionBrainCipher Client Area snapshot · 2025-02-25 02:40 -
brain4zoadgr6clxecixffvxjsw43cflyprnpfeak72nfh664kqqriyd.onionBrainCipher Client Area snapshot · 2025-10-03 21:17 -
4ldgw2wuidqu5ef3rzx4byonf3y7rdnh43jiw2z4sbtjiwic6gkov7yd.onionBrain Cipher FileSharing snapshot · 2025-11-12 09:02 -
4ldgw2wuidqu5ef3rzx4byonf3y7rdnh43jiw2z4sbtjiwic6gkov7yd.onionNot Found snapshot · 2025-11-12 10:03 -
zktnif5vckhmz5tyrukp5bamatbfhkxjnb23rspsanyzywcrx3bvtqad.onionBrainCipher Storage snapshot · 2026-01-01 23:02 -
yt7beb7fj6xbh4dndrlyvl3gn4ck36qn2oqheiqjs4bp3wspj3wgpcad.onionBrainCipher Storage snapshot · 2026-01-01 23:03 -
i6b4r6blgmm3r62zj42qxn6bvcbcrslcg6b6uwqws6xhnxz2howbhkid.onionBrainCipher Storage snapshot · 2026-01-01 23:36 -
pzghjpkm2liszmvjsttflp475zqxgrywjhr7xagc4bqfb2a7aw3qysyd.onionBrainCipher Storage snapshot · 2026-01-01 23:23 -
5v6tgs5xyuvl7kpg5b26e54kddlxdvktep2qmglawrohksv3qjwvw7qd.onionBrainCipher Storage snapshot · 2026-01-01 23:26 -
lhdv4ydjx5idzvntdrmcbwsh3dhdi3ww5hoz3ws2d5q5jlfewdacx4qd.onionBrainCipher Storage snapshot · 2026-01-01 23:29 -
oe7kcuvnulmdzir6zkewv5p353kc7qjf5tyqxfxabhzsm26pji44elqd.onionBrainCipher Storage snapshot · 2026-01-01 23:33 -
zv27q4tjvqxelm2imgztfg7gtl3v56oqabe77hiufqoqilis2dgcdsad.onionBrainCipher Storage snapshot · 2026-01-01 23:14 -
ubetdhmgnry4jk7ya7gh7p4hm4c3c57srkw62oc6hjmvvvkrqeybjjid.onionBrainCipher Storage snapshot · 2026-01-01 23:35 -
ixvarmokkir6t6fzpn7prussp3ulys66aeivrhcvrmfowqi2gi2fgryd.onionBrainCipher Storage snapshot · 2026-01-01 23:10 -
tahr6kwobsi7fj5j3hoyzxr34ipyiyuv2svhteht5td4etq23bcx7tyd.onionBrainCipher Storage snapshot · 2026-01-01 22:08 -
ncyg34lipi3w2u7yvxl3swr6wj6lsoeix3grrdsn6nmcv4r7vntanoid.onionBrainCipher Storage snapshot · 2026-01-01 23:05 -
bgpeqy3d5svuikeaueitix6zosg3pzekw77viulnucsiqsn4sjr65iyd.onionBrainCipher Storage snapshot · 2026-01-01 22:16 -
as7fbsjvifse52ek5qnptfgvkduvvnl56adb3jjgk6k3p7bisipvotyd.onionBrainCipher Storage snapshot · 2026-01-01 23:34 -
xangddavm54rgsju7iceahxztbqrcflzunffwbaswwhhftieygc4j3ad.onionBrainCipher Storage snapshot · 2026-01-01 23:20 -
q226mkoikzgyu33jin7ox3qo6tea7yhlgz52p5lslpj73edtocsz4wqd.onionBrainCipher Storage snapshot · 2026-01-01 23:32 -
hdgfvxxkepllbvqvk7vrudgwq55tg4joo4xpajaa3nv5gzpake66bnid.onionBrainCipher Storage snapshot · 2026-01-01 23:00 -
jgkgqztfmwk53wlttsjo6i3nmwtzoch2oi2bocqzb4zmp6kfspuiaead.onionBrainCipher Storage snapshot · 2026-01-01 23:21 -
braincgksuixxkpkme7zlpkh7u47oryxx574d74ws4eal4t2mxyahbqd.onionBrainCipher Client Area snapshot · 2025-11-12 09:02 -
zke5xim35cfolmq2h5i5sfmcoxr4pbpkfjwtq5lf6o4zo7avfcvnb5qd.onionBrainCipher Storage snapshot · 2026-01-01 23:30 -
3frnhzcnlkjnw5q3tm6elzizinm2k3bmrtf2xwqjzpcxzeqwn2tv6wyd.onionsnapshot · 2026-08-06 21:39 -
6ft2dfh26wm3w44orpjcgviutvfp25ez2iyh5ego5egvfmifrws7vvqd.onionsnapshot · 2026-08-06 21:30 -
zijgmuqjzb6dc7pofxhtaiz36qqyg35lhutybmzaz6whzgei2casjgid.onionsnapshot · 2026-08-06 21:37
Recent victims
The 50 most recent victims claimed by BRAIN-CIPHER. Total in the index: 73.
| Date listed | Victim | Description |
|---|---|---|
| 2026-07-22 | windiam.com | We have about 55,000(55k) documents and files of this company, with a … |
| 2026-07-09 | robroy.com | We have more 250,000 files. If you think you are here by mistake, plea… |
| 2026-07-09 | iac-intl.com | We have stolen more than 710,000 files and documents, totaling over 10… |
| 2026-07-01 | digitaldynamics.com | Details later. If you think you are here by mistake, please contact us… |
| 2026-07-01 | goldenstateortho.com | We have about 150k documents and files of this company, with a total s… |
| 2026-07-01 | printronix.com | We have about 110k documents and files of this company, with a total s… |
| 2026-06-30 | paipharma.com | Large volume data breach. Total size 1,4 Terabytes. Coming soon. |
| 2026-06-22 | sterlinggloballtd.com | We have 100gb files and documents. If you think you are here by mistak… |
| 2026-06-22 | eggetttax.ca | 330,000 documents and files of this company, with a total size of over… |
| 2026-06-19 | themintgaming.com | Once the timer runs out, we will publish the latest Oasis 360 by Arist… |
| 2026-06-15 | anglomoil.com | We have more than 100 thousand documents from Anglomoil, Avantage Glob… |
| 2026-06-15 | alu-rex.com | We have 150gb files and documents. If you think you are here by mistak… |
| 2026-06-01 | squamish.net | We have a lot of confidential documents. If you think you are here by … |
| 2026-05-21 | sheppadviser.com.au | We have more 350GB of data. If you think you are here by mistake, plea… |
| 2026-05-12 | ice.org.uk | We have more 1TB of data. If you think you are here by mistake, please… |
| 2026-04-25 | bridgeway-consulting.co.uk | We have 500GB of data. If you think you are here by mistake, please co… |
| 2026-04-06 | soundinsurance.ca | We have 500GB of data. If you think you are here by mistake, please co… |
| 2026-04-06 | endeavourautomotive.co.uk | We have 150GB of data. If you think you are here by mistake, please co… |
| 2026-04-06 | eworldme.com | We have 300GB of data. If you think you are here by mistake, please co… |
| 2026-03-05 | liteline.com | We have 350GB of data. If you think you are here by mistake, please co… |
| 2026-03-05 | westonconsulting.com | We have 800GB of data. If you think you are here by mistake, please co… |
| 2026-02-19 | exceldor.ca | We have about 1.5 TB of data from the company's servers. We will publi… |
| 2026-01-22 | flbgroup.com | |
| 2026-01-22 | kisnet.co.jp | |
| 2026-01-22 | nwlr.ca | |
| 2025-10-30 | fsbgroup.ca | |
| 2025-10-30 | semag.fr | |
| 2025-10-30 | axxia.fr | |
| 2025-10-20 | oxfordcounty.ca | |
| 2025-10-20 | cdom.org | |
| 2025-09-16 | bmsi.org | |
| 2025-08-04 | bw-lv.de | |
| 2025-07-28 | VIRTUALWEB.US | |
| 2025-07-25 | jorgefernandez.es | |
| 2025-05-03 | ddecor.com | |
| 2025-05-03 | ruizre.es | |
| 2025-05-03 | soundtransit.org | |
| 2025-05-03 | valedolobo.com | |
| 2025-05-03 | edisoft.es | |
| 2025-05-03 | iycsa.com.co | |
| 2025-04-11 | mbmdubai.com | |
| 2025-02-25 | neatem.fr | Update! | |
| 2025-02-19 | Pulmonary Physicians of South Florida Clinics | Data security breach! | |
| 2025-02-17 | neatem.fr | |
| 2025-02-17 | Cirion Technologies | |
| 2024-12-23 | It seems that it was easier to pay and calmly fix everything. | |
| 2024-12-17 | Modern Dental Group Limited | |
| 2024-12-12 | Estar Seguros, S.A. | |
| 2024-12-12 | Cristal y Lavisa S.A. de C.V. | |
| 2024-12-04 | Deloitte UK |