bavacai
ransomware group · aka unknown · unknown · active since unknown publicly; leak-site posts tracked by this dashboard since 2026-06-15, with some listed posts appearing to predate that tracking start
Bavacai is a ransomware and data-extortion operation tracked by this dashboard primarily through its leak-site victim listings. Widely reported vendor research, law-enforcement advisories, and blockchain-analytics coverage of the group are minimal or absent, so key attributes such as aliases, country of origin, and earliest activity remain unknown. Per dashboard telemetry, it posted 3 victims since 2026-06-15, with its most recent post on 2026-06-30 and no new listings in the past 30 days. Victim names on its leak site suggest internationally distributed, generally small-to-mid-sized organizations in Canada, France, Germany, and the United States, spanning nonprofit social services, municipal government, legal, and industrial sectors. Defenders should treat Bavacai as a low-volume but recently active extortion brand pending broader public reporting.
- Operates a leak site publicly naming extortion victims, consistent with a data-theft extortion model
- Low posting cadence: 3 victims listed since 2026-06-15 per dashboard telemetry
- Victim names indicate multi-country targeting (Canada, France, Germany, United States) (inferred from leak-site listings)
- Victim names indicate targeting of small-to-mid-sized organizations across nonprofit, municipal, legal, and industrial sectors (inferred from leak-site listings)
- Initial access vectors, tooling, and encryption techniques: unknown (no widely reported vendor research)
- Affiliation with established ransomware families or affiliate programs: unknown
Penticton and District Society for Community Living (Canada; community-living nonprofit), Mairie de Thiverval-Grignon (France; municipality), SGS GmbH (as listed on leak site), Karnes Legal (as listed on leak site), Estrela / Estrela Industrial (as listed on leak site), Dadolighting (as listed on leak site), T Online (as listed on leak site), FunkeScheid (as listed on leak site), Dolrad (as listed on leak site), Forces (as listed on leak site)
No public figure.
Leak-site victims28 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| Forces | · Jun 30, 2026 | Organization with 28 emails extracted. Domain: forces.gc.ca |
| Penticton and District Society for Community Living | · Jun 30, 2026 | Canadian charity providing disability-related services. CRA Registration: 119090686RR0001 |
| Bd | · Jun 15, 2026 | Organization with 772 emails extracted. Domain: bd.zh.ch |
| Dolrad | · Jun 3, 2026 | Organization with 69 emails extracted. Domain: dolrad.ae |
| Mairie Thiverval Grignon | · May 28, 2026 | Organization with 162 emails extracted. Domain: mairie-thiverval-grignon.fr |
| Dadolighting | · May 25, 2026 | Organization with 17 emails extracted. Domain: dadolighting.com |
| T Online | · May 25, 2026 | Organization with 823 emails extracted. Domain: t-online.de |
| FunkeScheid | · May 25, 2026 | Notarkanzlei FunkeScheid, Kanzlei im Ostend, Frankfurt. 9755 emails. AD: Kanzlei.FunkeScheid.com |
| Sgs Gmbh | · May 22, 2026 | Organization with 933 emails extracted. Domain: sgs-gmbh.com |
| Karneslegal | · May 19, 2026 | Organization with 23 emails extracted. Domain: karneslegal.com |
| Estrela | · May 18, 2026 | Organization with 11 emails extracted. Domain: estrela.ind |
| Estrela Industrial | · May 16, 2026 | Organization with 1201 emails extracted. Domain: estrela.ind.br |
| Elken Sdn Bhd | · May 5, 2026 | MLM / health & beauty products company. ~16k emails extracted. |
| Bandeirante Supermercados | · May 5, 2026 | Brazilian supermarket chain. |
| Strategic Imports | · May 5, 2026 | Australian auto parts/batteries importer. Brands: Strategic Imports, Auto Parts Now, Discount Batteries Now. User: bstuart (Brad Stuart). QNAP NAS (CACHEDEV1_DATA). |
| Magnolia (Israel) | · May 5, 2026 | Israeli jewelry company. Silver & accessories, participates in Vicenza jewelry fair (2025/2026). Sells via buyme.co.il gift cards. ~38k files, invoices in Hebrew (SI/IN/OV prefix). |
| Trimble Inc / Gerrard Inc | · May 5, 2026 | Technology company Trimble (trimble.com) and Gerrard Inc (gerrardinc.com). ~18 Trimble email addresses. |
| Atencio Engineering | · May 5, 2026 | Civil engineering & land surveying firm. Services: site plans, boundary surveys, OWTS (septic) design, fire line design, elevation certificates, flood plain analysis. Clients in Las Animas County, Pueblo County, Florence CO area. |
| SIT Group / Robusta | · May 5, 2026 | Italian company SIT Group (sitgroup.it) and Bulgarian Robusta (robusta.bg). Also abv.bg emails. |
| Desert Christian Schools (DCS) | · May 5, 2026 | K-12 Christian school affiliated with First Baptist Church of Lancaster, CA. ADP payroll, DCFS childcare program, City of Lancaster Water Safety program. Financial docs: P&L, Balance Sheet, Trial Balance, 1099s. School Board minutes 2025. |
| CourtSmart | · May 5, 2026 | Court technology company. Domain courtsmart.com / COURTSMART2. Dev server: dev-rich20.courtsmart.com. Connections to JIS.org, nashville.org. |
| Hathcock (Personal) | · May 5, 2026 | Personal comprehensive reports. Individuals: Noel Ray Hathcock, Trinity John Hathcock. |
| ActionAid / TACOSA | · May 5, 2026 | NGO sector. Domains: actionaid.org, tacosa.org.za, immigration.go.tz. |
| Palmers Relocations | · May 5, 2026 | Australian international removals & relocation company. FIDI accredited, ISO 9001:2015 certified. Services: household moves, storage, customs, immigration (IMMI/VEVO). Operates Melbourne area (Pascoe Vale, Dandenong, Caulfield). |
| Académie de Montpellier / CSJM | · May 5, 2026 | French public school network. Domain CSJM.BEZIERS, part of Académie de Montpellier (ac-montpellier.fr). Occitanie region (laregion.fr). Teacher and admin staff credentials. |
| Colegio María Inmaculada (CMI) | · May 5, 2026 | Catholic school in Moravia, Costa Rica. Domain cmi.local / mariainmaculada.ed.cr. Servers: CMI-DC01, CMI-APP, CMI-HTTP2, main-server1/2. |
| CEAGESP / Netfeirasp | · May 5, 2026 | Brazilian produce wholesale market network. Domain netfeirasp.ceagesp (CEAGESP). Also demarchibrasil.com.br accounts. |
| Raycolighting | · May 5, 2026 | Organization with 2 emails extracted. Domain: raycolighting.com |
In the newsAll →
No articles mention this group yet.