THREAT ACTOR
BRAVOX_
ActiveBRAVOX is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem: file encryption combined with the threat of stolen-data publication on a public leak site. It continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of BRAVOX, including incident write-ups, attribution notes and additional context, see the Threat Groups archive or run a site search.
Victims by year
- 2026 29
Leak site mirrors
2 mirrors tracked, 1 currently reachable. These are criminal-infrastructure URLs; links are deliberately not provided.
-
bravoxxtrmqeeevhl7gdh2yzvlrjxajr66d33c7ozosrccx4cz7cepad.onionBravoX Blog snapshot · 2026-09-23 01:14 -
bravoxxwcfz5qk43ychgveprpd5mw5hvxfs4a2uz2okx7mumiht4fzyd.onionBravoX Blog snapshot · 2026-09-22 23:36
Recent victims
The 50 most recent victims claimed by BRAVOX. Total in the index: 29.
| Date listed | Victim | Description |
|---|---|---|
| 2026-09-20 | TOWILL 🇺🇸 | A geomatics veteran since 1955, providing surveying, LiDAR, photogramm… |
| 2026-09-01 | SCHMIDT 🇺🇸 | Abrasive Blasting Systems and Engineering Solutions for Industry. |
| 2026-08-17 | Moores 🇬🇧 | Kitchen solutions provider for housing developers. |
| 2026-08-10 | Elettrica System 🇮🇹 | Electrical and Engineering Solutions for Business. |
| 2026-08-10 | Verona 83 🇮🇹 | Integrated services, logistics and event management. |
| 2026-08-08 | MEDICOS 🇫🇷 | European manufacturer of packaging for beauty and food. Expertise in p… |
| 2026-08-06 | MITC AG 🇨🇭 | Industrial Engineering, IT Solutions and Technical Services. |
| 2026-07-25 | A&A Safety 🇺🇸 | Traffic Control and Road Safety Services. |
| 2026-07-07 | PB Fiduciaire SA 🇨🇭 | Accounting, taxation, auditing, financial consulting for businesses. |
| 2026-06-24 | Meta 🇧🇷 | Occupational health services, workplace safety, ergonomics, preventive… |
| 2026-06-18 | SELECT WINES 🇨🇦 | The company is engaged in importing and distributing premium wines, su… |
| 2026-06-12 | CCS GLOBAL TECH 🇺🇸 | They provide digital and cloud solutions for business processes. |
| 2026-06-01 | Grupo Mauá 🇧🇷 | Operates in the construction, real estate, energy, and infrastructure … |
| 2026-05-29 | AcademyHealth 🇺🇸 | They research and promote policy and innovations in healthcare. |
| 2026-05-24 | Emek Elektrik 🇹🇷 | Emek Elektrik specializes in manufacturing high-performance electrical… |
| 2026-05-23 | Salvation Army 🇨🇦 | Provides social services, emergency aid, rehabilitation, and community… |
| 2026-05-12 | Rivadeneyra Treviño 🇲🇽 | Rivadeneyra Treviño provides expert corporate legal advice, specializi… |
| 2026-05-07 | Soprolux 🇫🇷 | The company provides high-quality gourmet and specialty products. |
| 2026-04-23 | 1st Solution CTC 🇩🇪 | |
| 2026-04-06 | Aculab 🇬🇧 | |
| 2026-03-11 | UMBERG TREUHAND AG 🇨🇭 | |
| 2026-03-02 | Soreco 🇨🇭 | |
| 2026-02-16 | OEC Bretagne 🇫🇷 | |
| 2026-02-10 | FUSION HILL 🇺🇸 | |
| 2026-02-08 | **Removed** | |
| 2026-02-05 | John O's Foods 🇨🇦 | |
| 2026-01-23 | SPEC 🇺🇸 | |
| 2026-01-23 | WVPCA 🇺🇸 | |
| 2026-01-23 | Hood River Dental 🇺🇸 |
CONFIRMED ATTACKS
Bravox confirmed attacks: 3 verified incidents
Ransomnews has verified 3 Bravox incidents against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. The confirmed record runs from February 2026 to July 2026. Switzerland accounts for 2 of them (67%), with victims recorded in 2 countries in total. The most affected sector is finance, at 2 confirmed victims. A ransom payment was publicly confirmed in 0 cases and publicly refused in 2; the outcome is unrecorded in the remaining 1.
Confirmed victims by year
Most affected sectors
Most affected countries
Verified Bravox incidents
| Date | Organisation | Sector | Location | Records | Ransom paid | Source |
|---|---|---|---|---|---|---|
| July 2026 | PB Fiduciaire SA | Finance | Yverdon-les-Bains, Switzerland | — | No | Source |
| March 2026 | Soreco AG | Technology | Schwerzenbach, Switzerland | — | No | Source |
| February 2026 | Ordre des Experts-Comptables de Bretagne | Finance | Saint-Grégoire, France | — | Unknown | Source |
Claimed vs confirmed. The figures above the fold on this page come from Bravox's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design: most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.