Skip to main content
Darkfield

Operator dossier

Bavacai is a ransomware operator currently active on public leak sites. Darkfield has indexed 16 public victims claimed by this operator between May 5, 2026. Based on the limited publicly available information, Bavacai is a relatively obscure ransomware operation first observed in May 2026 with primarily financial motivations, having targeted at least 16 known victims across multiple countries and sectors. The group's origin and affiliations remain unclear due to insufficient public documentation from major cybersecurity organizations, though their operational model and whether they function as a Ransomware-as-a-Service operation or independent entity has not been definitively established by security researchers. Their attack methodology, specific tools, and encryption techniques have not been extensively documented in public threat intelligence reports, though their targeting pattern suggests opportunistic victim selection across diverse industries including business services, education, consumer services, and agriculture sectors, with primary focus on victims in the United States, United Kingdom, Brazil, France, and Israel. No major high-profile campaigns or significant law enforcement actions against Bavacai have been publicly reported by CISA, FBI, or established cybersecurity firms like Mandiant. Given the recent emergence timeline and limited public intelligence reporting, the group's current operational status remains uncertain with insufficient data to determine whether they remain active or have ceased operations.

Most-targeted sectors

Most-affected countries

Recent disclosures by Bavacai

All 16 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for Bavacai →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Active ransomware operator

← All groups

Bavacai

16 victims indexed · first seen 2 months ago · last activity 2 months ago

16
Victims indexed
#174 of 364 tracked operators
<1m
Active period
May 2026 → May 2026
9
Countries hit
top US · 3

At a glance

Status
active
First seen
2 months ago
Last activity
2 months ago
Primary sector
Business Services · 3 hits

About

Based on the limited publicly available information, Bavacai is a relatively obscure ransomware operation first observed in May 2026 with primarily financial motivations, having targeted at least 16 known victims across multiple countries and sectors. The group's origin and affiliations remain unclear due to insufficient public documentation from major cybersecurity organizations, though their operational model and whether they function as a Ransomware-as-a-Service operation or independent entity has not been definitively established by security researchers. Their attack methodology, specific tools, and encryption techniques have not been extensively documented in public threat intelligence reports, though their targeting pattern suggests opportunistic victim selection across diverse industries including business services, education, consumer services, and agriculture sectors, with primary focus on victims in the United States, United Kingdom, Brazil, France, and Israel. No major high-profile campaigns or significant law enforcement actions against Bavacai have been publicly reported by CISA, FBI, or established cybersecurity firms like Mandiant. Given the recent emergence timeline and limited public intelligence reporting, the group's current operational status remains uncertain with insufficient data to determine whether they remain active or have ceased operations.

References

1 link

External sources curated by the MISP threat-intel community.

Timeline

1 months
2026-05-01T00:00:00+00:00 · 16
2026-05-01T00:00:00+00:002026-05-01T00:00:00+00:00

Top countries

🇺🇸 United States
3
🇬🇧 United Kingdom
3
🇧🇷 Brazil
2
🇫🇷 France
1
🇮🇱 Israel
1
🇨🇷 Costa Rica
1
🇮🇹 Italy
1
🇦🇺 Australia
1
United States dossier →United Kingdom dossier →Brazil dossier →France dossier →

Top sectors

Business Services
3
Education
3
Consumer Services
2
Agriculture and Food Production
1
Technology
1
Public Sector
1
Manufacturing
1
Construction
1
Business Services dossier →Education dossier →Consumer Services dossier →Agriculture and Food Production dossier →

MITRE ATT&CK

1 techniques · 1 tactics

Tactics

Impact

Techniques

  • T1486Data Encrypted for Impact

Recent victims

Loading…

Source

Updated 2 months ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time Bavacai posts a victim.

Add Bavacai to your watchlist — Pro pings you within 5 minutes of any new Bavacai leak-site post, Telegram callout, or affiliate-rebrand inference.