Skip to main content
Darkfield

Operator dossier

Braincipher (also tracked as brain cipher) is a ransomware operator currently active on public leak sites. Darkfield has indexed 69 public victims claimed by this operator between July 1, 2024 and July 9, 2026. Braincipher is a recently emerged ransomware group that was first observed in July 2024, operating with apparent financial motivations and targeting organizations primarily across North America and Europe. The group's origin and potential affiliations remain largely undocumented by major threat intelligence organizations, though their targeting patterns suggest a broad opportunistic approach rather than nation-state backing, likely operating as an independent entity rather than through established ransomware-as-a-service infrastructure. Their attack methodology and specific technical capabilities have not been extensively documented by CISA, FBI, or major security research firms, though their victim distribution across 44 confirmed targets spanning business services, manufacturing, technology, and healthcare sectors indicates a generalist approach to target selection rather than sector-specific expertise. No major high-profile campaigns or significant law enforcement actions have been publicly documented against this group by reputable sources, suggesting either a relatively low-impact operational scale or insufficient intelligence collection on their activities. As of current reporting, the group's operational status remains unclear due to limited public documentation from established threat intelligence sources.

Most-targeted sectors

Most-affected countries

Recent disclosures by Braincipher

Most recent 58 of 69 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for Braincipher →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Active ransomware operator

← All groups

Braincipher

aka brain cipher · 69 victims indexed · first seen 2 years ago · last activity 6 days ago

69
Victims indexed
#92 of 364 tracked operators
2y 0m
Active period
Jul 2024 → Jul 2026
26
Countries hit
top United States · 11

At a glance

Status
active
Aliases
brain cipher
First seen
2 years ago
Last activity
6 days ago
Onion sites
9 known endpoints
Primary sector
Business Services · 12 hits

About

Braincipher is a recently emerged ransomware group that was first observed in July 2024, operating with apparent financial motivations and targeting organizations primarily across North America and Europe. The group's origin and potential affiliations remain largely undocumented by major threat intelligence organizations, though their targeting patterns suggest a broad opportunistic approach rather than nation-state backing, likely operating as an independent entity rather than through established ransomware-as-a-service infrastructure. Their attack methodology and specific technical capabilities have not been extensively documented by CISA, FBI, or major security research firms, though their victim distribution across 44 confirmed targets spanning business services, manufacturing, technology, and healthcare sectors indicates a generalist approach to target selection rather than sector-specific expertise. No major high-profile campaigns or significant law enforcement actions have been publicly documented against this group by reputable sources, suggesting either a relatively low-impact operational scale or insufficient intelligence collection on their activities. As of current reporting, the group's operational status remains unclear due to limited public documentation from established threat intelligence sources.

References

7 links

External sources curated by the MISP threat-intel community.

Timeline

13 months
2024-07-01T00:00:00+00:00 · 62024-08-01T00:00:00+00:00 · 62024-09-01T00:00:00+00:00 · 12024-10-01T00:00:00+00:00 · 42024-11-01T00:00:00+00:00 · 22024-12-01T00:00:00+00:00 · 72025-05-01T00:00:00+00:00 · 92025-07-01T00:00:00+00:00 · 22025-08-01T00:00:00+00:00 · 12025-09-01T00:00:00+00:00 · 12025-10-01T00:00:00+00:00 · 52026-05-01T00:00:00+00:00 · 132026-06-01T00:00:00+00:00 · 1
2024-07-01T00:00:00+00:002026-06-01T00:00:00+00:00

Top countries

🇺🇸 United States
11
🇫🇷 France
5
🇬🇧 United Kingdom
4
🇲🇽 Mexico
4
🇨🇦 Canada
4
🇨🇦 Canada
3
🇪🇸 Spain
3
🇺🇸 United States
2
United States dossier →France dossier →United Kingdom dossier →Mexico dossier →

Top sectors

Business Services
12
Technology
8
Manufacturing
7
Healthcare
3
Financial
2
Transportation/Logistics
2
Agriculture and Food Production
2
Financial Services
2
Business Services dossier →Technology dossier →Manufacturing dossier →Healthcare dossier →

MITRE ATT&CK

7 techniques · 5 tactics

Tactics

Initial AccessExecutionDefense EvasionDiscoveryImpact

Techniques

  • T1566Phishing
  • T1190Exploit Public-Facing Application
  • T1204User Execution
  • T1027Obfuscated Files or Information
  • T1083File and Directory Discovery
  • T1082System Information Discovery
  • T1486Data Encrypted for Impact

Recent victims

Loading…

Onion infrastructure

9 known
  • http://4ldgw2wuidqu5ef3rzx4byonf3y7rdnh43jiw2z4sbtjiwic6gkov7yd.onion
  • http://77nrxelcwh47yikvpaz2rvtsten4sen2elybo5r5st6wlxsbitv255qd.onion
  • http://brain4zoadgr6clxecixffvxjsw43cflyprnpfeak72nfh664kqqriyd.onion
  • http://mybmtbgd7aprdnw2ekxht5qap5daam2wch25coqerrq2zdioanob34ad.onion
  • http://mybmtbgd7aprdnw2ekxht5qap5daam2wch25coqerrq2zdioanob34ad.onion/
  • http://p6wmotxzvg34tdmpwm4beqgrcyp5iys43snkccsahnw74la3k3xx6pad.onion
  • http://vkvsgl7lhipjirmz6j5ubp3w3bwvxgcdbpi3fsbqngfynetqtw4w5hyd.onion
  • http://xbg52c5agytmtjpwfu7mrs4xtaitc4mukkiy2kqdxeqbcmuhaid.onion
  • http://zktnif5vckhmz5tyrukp5bamatbfhkxjnb23rspsanyzywcrx3bvtqad.onion

Source

Updated 6 days ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time Braincipher posts a victim.

Add Braincipher to your watchlist — Pro pings you within 5 minutes of any new Braincipher leak-site post, Telegram callout, or affiliate-rebrand inference.