bravox
Intelligence Profile
BravoX is a selective ransomware-as-a-service operation that surfaced publicly in January 2026 after advertising on the RAMP underground forum, targeting primarily US-based organizations in healthcare and retail while applying strict affiliate vetting requirements including proof of access or a financial deposit.
Threat Analysis
bravox is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of financial.
Financially motivated threat actors like bravox prioritize monetary gain through methods such as ransomware deployment, banking trojans, cryptocurrency theft, BEC scams, or credential harvesting for resale on underground markets.
Ransomware Victims (33)
CTIWATCH tracks 33 organizations claimed as victims by bravox on its data leak site, with attack dates, sectors and countries.
View full victims list →Known Campaigns
Bravox is conducting an active ransomware campaign targeting organizations across 2 countries. Primary targets: Technology. 6 confirmed victims recorded in the last 45 days. Campaign status: ACTIVE (last activity 6 Apr 2026).