APT / THREAT GROUP💰 FINANCIAL

bravox

33
victims
1
campaigns
1
aliases

Intelligence Profile

BravoX is a selective ransomware-as-a-service operation that surfaced publicly in January 2026 after advertising on the RAMP underground forum, targeting primarily US-based organizations in healthcare and retail while applying strict affiliate vetting requirements including proof of access or a financial deposit.

Threat Analysis

bravox is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of financial.

Financially motivated threat actors like bravox prioritize monetary gain through methods such as ransomware deployment, banking trojans, cryptocurrency theft, BEC scams, or credential harvesting for resale on underground markets.

Ransomware Victims (33)

CTIWATCH tracks 33 organizations claimed as victims by bravox on its data leak site, with attack dates, sectors and countries.

View full victims list →

Known Campaigns

Bravox — Active Campaign April 2026

Bravox is conducting an active ransomware campaign targeting organizations across 2 countries. Primary targets: Technology. 6 confirmed victims recorded in the last 45 days. Campaign status: ACTIVE (last activity 6 Apr 2026).

🎯 Technology
ACTIVEMEDIUM2026

External References

Quick Facts

TypeAPT / Threat Group
Motivation💰 financial
Aliases1

Also Known As

bravox

DLS Infrastructure

● ONLINEbravoxxtrmqeeevhl7gdh2yzvlrjxajr66d33c7ozosrccx4cz7cepad.onion
● ONLINEbravoxxwcfz5qk43ychgveprpd5mw5hvxfs4a2uz2okx7mumiht4fzyd.onion

Research Links

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.