THREAT ACTOR
BRAIN-CIPHER_
ActiveBRAIN-CIPHER is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem: file encryption combined with the threat of stolen-data publication on a public leak site. It continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of BRAIN-CIPHER, including incident write-ups, attribution notes and additional context, see the Threat Groups archive or run a site search.
84
Victims tracked
28 / 58
Active mirrors
2024-07-02
First listing
2026-09-17
Most recent
Victims by year
- 2026 36
- 2025 20
- 2024 28
Leak site mirrors
58 mirrors tracked, 28 currently reachable. These are criminal-infrastructure URLs; links are deliberately not provided.
-
mybmtbgd7aprdnw2ekxht5qap5daam2wch25coqerrq2zdioanob34ad.onionBrain Cipher Client Area snapshot · 2024-07-07 15:04 -
vkvsgl7lhipjirmz6j5ubp3w3bwvxgcdbpi3fsbqngfynetqtw4w5hyd.onionBrain Cipher Dataleak snapshot · 2026-09-23 05:30 -
cuuhrxbg52c5agytmtjpwfu7mrs4xtaitc4mukkiy2kqdxeqbcmuhaid.onionsnapshot · 2024-12-11 12:22 -
p6wmotxzvg34tdmpwm4beqgrcyp5iys43snkccsahnw74la3k3xx6pad.onionBrainCipher Client Area snapshot · 2025-02-25 02:40 -
brain4zoadgr6clxecixffvxjsw43cflyprnpfeak72nfh664kqqriyd.onionBrainCipher Client Area snapshot · 2025-10-03 21:17 -
4ldgw2wuidqu5ef3rzx4byonf3y7rdnh43jiw2z4sbtjiwic6gkov7yd.onionBrain Cipher FileSharing snapshot · 2025-11-12 09:02 -
4ldgw2wuidqu5ef3rzx4byonf3y7rdnh43jiw2z4sbtjiwic6gkov7yd.onionNot Found snapshot · 2025-11-12 10:03 -
zktnif5vckhmz5tyrukp5bamatbfhkxjnb23rspsanyzywcrx3bvtqad.onionBrainCipher Storage snapshot · 2026-01-01 23:02 -
yt7beb7fj6xbh4dndrlyvl3gn4ck36qn2oqheiqjs4bp3wspj3wgpcad.onionBrainCipher Storage snapshot · 2026-01-01 23:03 -
i6b4r6blgmm3r62zj42qxn6bvcbcrslcg6b6uwqws6xhnxz2howbhkid.onionBrainCipher Storage snapshot · 2026-01-01 23:36 -
pzghjpkm2liszmvjsttflp475zqxgrywjhr7xagc4bqfb2a7aw3qysyd.onionBrainCipher Storage snapshot · 2026-01-01 23:23 -
5v6tgs5xyuvl7kpg5b26e54kddlxdvktep2qmglawrohksv3qjwvw7qd.onionBrainCipher Storage snapshot · 2026-01-01 23:26 -
lhdv4ydjx5idzvntdrmcbwsh3dhdi3ww5hoz3ws2d5q5jlfewdacx4qd.onionBrainCipher Storage snapshot · 2026-01-01 23:29 -
oe7kcuvnulmdzir6zkewv5p353kc7qjf5tyqxfxabhzsm26pji44elqd.onionBrainCipher Storage snapshot · 2026-01-01 23:33 -
zv27q4tjvqxelm2imgztfg7gtl3v56oqabe77hiufqoqilis2dgcdsad.onionBrainCipher Storage snapshot · 2026-01-01 23:14 -
ubetdhmgnry4jk7ya7gh7p4hm4c3c57srkw62oc6hjmvvvkrqeybjjid.onionBrainCipher Storage snapshot · 2026-01-01 23:35 -
ixvarmokkir6t6fzpn7prussp3ulys66aeivrhcvrmfowqi2gi2fgryd.onionBrainCipher Storage snapshot · 2026-01-01 23:10 -
tahr6kwobsi7fj5j3hoyzxr34ipyiyuv2svhteht5td4etq23bcx7tyd.onionBrainCipher Storage snapshot · 2026-01-01 22:08 -
ncyg34lipi3w2u7yvxl3swr6wj6lsoeix3grrdsn6nmcv4r7vntanoid.onionBrainCipher Storage snapshot · 2026-01-01 23:05 -
bgpeqy3d5svuikeaueitix6zosg3pzekw77viulnucsiqsn4sjr65iyd.onionBrainCipher Storage snapshot · 2026-01-01 22:16 -
as7fbsjvifse52ek5qnptfgvkduvvnl56adb3jjgk6k3p7bisipvotyd.onionBrainCipher Storage snapshot · 2026-01-01 23:34 -
xangddavm54rgsju7iceahxztbqrcflzunffwbaswwhhftieygc4j3ad.onionBrainCipher Storage snapshot · 2026-01-01 23:20 -
q226mkoikzgyu33jin7ox3qo6tea7yhlgz52p5lslpj73edtocsz4wqd.onionBrainCipher Storage snapshot · 2026-01-01 23:32 -
hdgfvxxkepllbvqvk7vrudgwq55tg4joo4xpajaa3nv5gzpake66bnid.onionBrainCipher Storage snapshot · 2026-01-01 23:00 -
jgkgqztfmwk53wlttsjo6i3nmwtzoch2oi2bocqzb4zmp6kfspuiaead.onionBrainCipher Storage snapshot · 2026-01-01 23:21 -
braincgksuixxkpkme7zlpkh7u47oryxx574d74ws4eal4t2mxyahbqd.onionBrainCipher Client Area snapshot · 2025-11-12 09:02 -
zke5xim35cfolmq2h5i5sfmcoxr4pbpkfjwtq5lf6o4zo7avfcvnb5qd.onionBrainCipher Storage snapshot · 2026-01-01 23:30 -
3frnhzcnlkjnw5q3tm6elzizinm2k3bmrtf2xwqjzpcxzeqwn2tv6wyd.onionsnapshot · 2026-09-23 05:03 -
6ft2dfh26wm3w44orpjcgviutvfp25ez2iyh5ego5egvfmifrws7vvqd.onionsnapshot · 2026-09-23 05:37 -
zijgmuqjzb6dc7pofxhtaiz36qqyg35lhutybmzaz6whzgei2casjgid.onionsnapshot · 2026-09-23 05:33
Recent victims
The 50 most recent victims claimed by BRAIN-CIPHER. Total in the index: 84.
| Date listed | Victim | Description |
|---|---|---|
| 2026-09-17 | hoyletanner.com | We have 33,500 (33.5k) files, the contents of which include: Contracts… |
| 2026-09-17 | aecom.com | We've obtained 670 GB of data that most likely belongs to a Fortune 50… |
| 2026-09-17 | xpera.ca | We have 20 GB of data belonging to this company. The data contains inf… |
| 2026-08-31 | ahadandco.com | We have about 405,000(405k) documents and files of your company, with … |
| 2026-08-31 | sago.com | We have approximately 56,000 (56k) documents and files belonging to yo… |
| 2026-08-31 | crmeyer.com | We have about 275,000(275k) documents and files of your company, with … |
| 2026-08-31 | ccsperfusion.com | We have approximately 306,000 (306k) documents and files belonging to … |
| 2026-08-31 | icot.es | If you use this hosting service, we have some bad news for you. We'll … |
| 2026-08-31 | aeiconsultants.com | We have about 35,000(35k) documents and files of your company, with a … |
| 2026-08-31 | syc.es | We have about 57,000(57k) documents and files of your company, with a … |
| 2026-08-31 | Adviesbureau De Beuckelaer BV | We have about 415,000(415k) documents and files of your company, with … |
| 2026-07-22 | windiam.com | We have about 55,000(55k) documents and files of this company, with a … |
| 2026-07-09 | robroy.com | We have more 250,000 files. If you think you are here by mistake, plea… |
| 2026-07-09 | iac-intl.com | We have stolen more than 710,000 files and documents, totaling over 10… |
| 2026-07-01 | digitaldynamics.com | Details later. If you think you are here by mistake, please contact us… |
| 2026-07-01 | goldenstateortho.com | We have about 150k documents and files of this company, with a total s… |
| 2026-07-01 | printronix.com | We have about 110k documents and files of this company, with a total s… |
| 2026-06-30 | paipharma.com | Large volume data breach. Total size 1,4 Terabytes. Coming soon. |
| 2026-06-22 | sterlinggloballtd.com | We have 100gb files and documents. If you think you are here by mistak… |
| 2026-06-22 | eggetttax.ca | 330,000 documents and files of this company, with a total size of over… |
| 2026-06-19 | themintgaming.com | Once the timer runs out, we will publish the latest Oasis 360 by Arist… |
| 2026-06-15 | anglomoil.com | We have more than 100 thousand documents from Anglomoil, Avantage Glob… |
| 2026-06-15 | alu-rex.com | We have 150gb files and documents. If you think you are here by mistak… |
| 2026-06-01 | squamish.net | We have a lot of confidential documents. If you think you are here by … |
| 2026-05-21 | sheppadviser.com.au | We have more 350GB of data. If you think you are here by mistake, plea… |
| 2026-05-12 | ice.org.uk | We have more 1TB of data. If you think you are here by mistake, please… |
| 2026-04-25 | bridgeway-consulting.co.uk | We have 500GB of data. If you think you are here by mistake, please co… |
| 2026-04-06 | soundinsurance.ca | We have 500GB of data. If you think you are here by mistake, please co… |
| 2026-04-06 | endeavourautomotive.co.uk | We have 150GB of data. If you think you are here by mistake, please co… |
| 2026-04-06 | eworldme.com | We have 300GB of data. If you think you are here by mistake, please co… |
| 2026-03-05 | liteline.com | We have 350GB of data. If you think you are here by mistake, please co… |
| 2026-03-05 | westonconsulting.com | We have 800GB of data. If you think you are here by mistake, please co… |
| 2026-02-19 | exceldor.ca | We have about 1.5 TB of data from the company's servers. We will publi… |
| 2026-01-22 | flbgroup.com | |
| 2026-01-22 | kisnet.co.jp | |
| 2026-01-22 | nwlr.ca | |
| 2025-10-30 | fsbgroup.ca | |
| 2025-10-30 | semag.fr | |
| 2025-10-30 | axxia.fr | |
| 2025-10-20 | oxfordcounty.ca | |
| 2025-10-20 | cdom.org | |
| 2025-09-16 | bmsi.org | |
| 2025-08-04 | bw-lv.de | |
| 2025-07-28 | VIRTUALWEB.US | |
| 2025-07-25 | jorgefernandez.es | |
| 2025-05-03 | ddecor.com | |
| 2025-05-03 | ruizre.es | |
| 2025-05-03 | soundtransit.org | |
| 2025-05-03 | valedolobo.com | |
| 2025-05-03 | edisoft.es |
CONFIRMED ATTACKS
Brain Cipher confirmed attacks: 11 verified incidents
Ransomnews has verified 11 Brain Cipher incidents against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. The confirmed record runs from June 2024 to May 2026. United States accounts for 3 of them (27%), with victims recorded in 9 countries in total. The most affected sector is government, at 4 confirmed victims. A ransom payment was publicly confirmed in 0 cases and publicly refused in 3; the outcome is unrecorded in the remaining 8. Where a figure was disclosed (2 cases), these incidents account for 664,741 exposed records.
11Verified incidents
9Countries
2024–2026Active range
0%Paid, where outcome known
Confirmed victims by year
Most affected sectors
Most affected countries
Verified Brain Cipher incidents
| Date | Organisation | Sector | Location | Records | Ransom paid | Source |
|---|---|---|---|---|---|---|
| May 2026 | Sterling Global Financial Ltd. | Finance | Nassau, Bahamas | — | Unknown | Source |
| November 2025 | Kansai Integrated Systems Co., Ltd. | Technology | Osaka, Japan | — | Unknown | Source |
| September 2025 | Oxford County | Government | Woodstock, Canada | — | Unknown | Source |
| July 2025 | Baltimore Medical System | Healthcare | Maryland, United States | — | Unknown | Source |
| July 2025 | Baden-Württembergischer Landesverband für Prävention und Rehabilitation | Healthcare | Renchen, Germany | — | Unknown | Source |
| December 2024 | RIBridges (Department of Administration) | Government | Rhode Island, United States | 650,000 | Unknown | Source |
| October 2024 | Cooperativa Telefónica de El Calafate (COTECAL) | Utilities | El Calafate, Argentina | — | No | Source |
| September 2024 | Hanwa Thailand Co., Ltd. | Retail | Bangkok, Thailand | — | Unknown | Source |
| August 2024 | Réunion des Musées Nationaux | Government | Paris, France | — | No | Source |
| June 2024 | Apex Global Solutions, LLC | Finance | New York, United States | 14,741 | Unknown | Source |
| June 2024 | Pusat Data Nasional (Ministry of Communication and Information Technology, Kominfo) | Government | Jakarta, Indonesia | — | No | Source |
Claimed vs confirmed. The figures above the fold on this page come from Brain Cipher's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design: most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.