Bavacai

Based on the limited publicly available information, Bavacai is a relatively obscure ransomware operation first observed in May 2026 with primarily financial motivations, having targeted at least 16 known victims across multiple countries and sectors. The group's origin and affiliations remain unclear due to insufficient public documentation from major cybersecurity organizations, though their operational model and whether they function as a Ransomware-as-a-Service operation or independent entity has not been definitively established by security researchers. Their attack methodology, specific tools, and encryption techniques have not been extensively documented in public threat intelligence reports, though their targeting pattern suggests opportunistic victim selection across diverse industries including business services, education, consumer services, and agriculture sectors, with primary focus on victims in the United States, United Kingdom, Brazil, France, and Israel. No major high-profile campaigns or significant law enforcement actions against Bavacai have been publicly reported by CISA, FBI, or established cybersecurity firms like Mandiant. Given the recent emergence timeline and limited public intelligence reporting, the group's current operational status remains uncertain with insufficient data to determine whether they remain active or have ceased operations.