brain cipher
ransomware group · aka Brain Cipher, BrainCipher · unknown (no public attribution; researchers noted in 2024 that its encryptor is based on the leaked LockBit 3.0 builder) · active since 2024-06
Victims · 7d
0flat
Victims · 30d
8active targets
Victims · 90d
18
All-time (tracked)
81since 2024-07-02
Last post
08-31 22:28UTC
Estimated earnings
—public reporting
Profile · glm-5.3-flash · updated
Brain Cipher is a double-extortion ransomware group first observed in June 2024, when it attacked Indonesia's national data center (PDNS2) and disrupted immigration, customs, and other public services. Researchers have found its encryptor is based on the leaked LockBit 3.0 builder, but the group's origin, country, and leadership remain unknown. It operates an affiliate-style ransomware-as-a-service model with a Tor leak site and negotiation portal, and has claimed victims across government, aviation, professional services, and healthcare, including Argentina's EANA and JIAAC in 2024. Activity has continued at a steady pace through 2026, with this dashboard recording 8 victims in the last 30 days and 20 in the last 90 days as of its last post on 2026-08-31.
Tactics & tooling
- Double extortion: encrypts systems and exfiltrates data, threatening publication on its Tor leak site
- Affiliate/RaaS-style operation with a Tor-based leak site and victim negotiation portal
- Uses an encryptor derived from the leaked LockBit 3.0 (LockBit Black) builder, per 2024 researcher analyses
- Initial access per incident is not consistently documented; in the 2024 Indonesia PDNS2 breach, Indonesian officials reported entry through an unpatched Sophos VPN, with CVE-2020-11899 cited in later analyses
- Multi-million-dollar demands scaled to large public-sector targets (about $8 million demanded in the 2024 Indonesia incident, per Reuters)
- Targets government and critical-infrastructure organizations alongside private firms; recent leak-site listings span professional services, healthcare, manufacturing, energy, and IT services
Targeted sectors
GovernmentAviation/TransportationProfessional services/ConsultingHealthcareManufacturing/ConstructionEnergy (including wind/renewables)IT services
Notable public victims
Indonesia National Data Center (PDNS2) - June 2024; disrupted immigration and other public services, EANA (Argentina's air navigation service provider) - 2024, JIAAC (Argentina's civil aviation accident investigation board) - 2024
Estimated earnings
No public figure.
Leak-site victims81 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| ahadandco.com | · 15d ago | We have about 405,000(405k) documents and files of your company, with a total size of over 300 GB. This data contains a significant amount of banking information, as well as the pe... |
| sago.com | · 15d ago | We have approximately 56,000 (56k) documents and files belonging to your company, including data on business relationships with more than 800 clients; data on research participants... |
| crmeyer.com | · 15d ago | We have about 275,000(275k) documents and files of your company, with a total size of over 330 GB. The data includes a customer database (~250 customers) — the largest ones are:... |
| ccsperfusion.com | · 15d ago | We have approximately 306,000 (306k) documents and files belonging to your company, with a total size of over 200 GB. 160k files containing complete employee personnel files; 75k f... |
| icot.es | · 15d ago | If you use this hosting service, we have some bad news for you. We'll soon be publishing more than 200 database backups that belong to you. Demo download: h4zmek6bf3lebauy7dtyxmui6... |
| aeiconsultants.com | · 15d ago | We have about 35,000(35k) documents and files of your company, with a total size of over 55 GB. The data includes: Personal Data, Real Estate Data, Internal Security/HR, Infrastruc... |
| syc.es | · 15d ago | We have about 57,000(57k) documents and files of your company, with a total size of over 40 GB. Contents: Personal data of thousands of candidates for top positions; Data on the fi... |
| Adviesbureau De Beuckelaer BV | · 15d ago | We have about 415,000(415k) documents and files of your company, with a total size of over 150 GB. Virtually all data falls under the protected category: 1) Financial data for more... |
| windiam.com | · Jul 22, 2026 | We have about 55,000(55k) documents and files of this company, with a total size of over 250 GB. If you think you are here by mistake, please contact us at brain.dataleak@cyberfear... |
| robroy.com | · Jul 9, 2026 | We have more 250,000 files. If you think you are here by mistake, please contact us at [email protected] |
| iac-intl.com | · Jul 9, 2026 | We have stolen more than 710,000 files and documents, totaling over 1050 GB. If you think you are here by mistake, please contact us at [email protected] |
| digitaldynamics.com | · Jul 1, 2026 | Details later. If you think you are here by mistake, please contact us at [email protected] |
| goldenstateortho.com | · Jul 1, 2026 | We have about 150k documents and files of this company, with a total size of more than 150 GB. If you think you are here by mistake, please contact us at [email protected]... |
| printronix.com | · Jul 1, 2026 | We have about 110k documents and files of this company, with a total size of more than 100 GB. If you think you are here by mistake, please contact us at [email protected]... |
| paipharma.com | · Jun 30, 2026 | Large volume data breach. Total size 1,4 Terabytes. Coming soon. |
| sterlinggloballtd.com | · Jun 22, 2026 | We have 100gb files and documents. If you think you are here by mistake, please contact us at [email protected] |
| eggetttax.ca | · Jun 22, 2026 | 330,000 documents and files of this company, with a total size of over 250 GB. If you think you are here by mistake, please contact us at [email protected] |
| themintgaming.com | · Jun 19, 2026 | Once the timer runs out, we will publish the latest Oasis 360 by Aristocrat database belonging to The Mint Gaming Hall, which contains the personal data of more than 250,000 player... |
| anglomoil.com | · Jun 15, 2026 | We have more than 100 thousand documents from Anglomoil, Avantage Global and Avantage Marine Group, whose director is Victor Prasad. If you think you are here by mistake, please co... |
| alu-rex.com | · Jun 15, 2026 | We have 150gb files and documents. If you think you are here by mistake, please contact us at [email protected] |
| squamish.net | · Jun 1, 2026 | We have a lot of confidential documents. If you think you are here by mistake, please contact us at [email protected] |
| sheppadviser.com.au | · May 21, 2026 | We have more 350GB of data. If you think you are here by mistake, please contact us at [email protected] |
| ice.org.uk | · May 12, 2026 | We have more 1TB of data. If you think you are here by mistake, please contact us at [email protected] |
| bridgeway-consulting.co.uk | · Apr 25, 2026 | We have 500GB of data. If you think you are here by mistake, please contact us at [email protected] |
| soundinsurance.ca | · Apr 6, 2026 | We have 500GB of data. If you think you are here by mistake, please contact us at [email protected] |
| endeavourautomotive.co.uk | · Apr 6, 2026 | We have 150GB of data. If you think you are here by mistake, please contact us at [email protected] |
| eworldme.com | · Apr 6, 2026 | We have 300GB of data. If you think you are here by mistake, please contact us at [email protected] |
| liteline.com | · Mar 5, 2026 | We have 350GB of data. If you think you are here by mistake, please contact us at [email protected] |
| westonconsulting.com | · Mar 5, 2026 | We have 800GB of data. If you think you are here by mistake, please contact us at [email protected] |
| exceldor.ca | · Feb 19, 2026 | We have about 1.5 TB of data from the company's servers. We will publish some of it in the near future. If you think you are here by mistake, please contact us at brain.dataleak@cy... |
| flbgroup.com | · Jan 22, 2026 | — |
| kisnet.co.jp | · Jan 22, 2026 | — |
| nwlr.ca | · Jan 22, 2026 | — |
| fsbgroup.ca | · Oct 30, 2025 | — |
| semag.fr | · Oct 30, 2025 | — |
| axxia.fr | · Oct 30, 2025 | — |
| oxfordcounty.ca | · Oct 20, 2025 | — |
| cdom.org | · Oct 20, 2025 | — |
| bmsi.org | · Sep 16, 2025 | — |
| bw-lv.de | · Aug 4, 2025 | — |
| VIRTUALWEB.US | · Jul 28, 2025 | — |
| jorgefernandez.es | · Jul 25, 2025 | — |
| ddecor.com | · May 3, 2025 | — |
| ruizre.es | · May 3, 2025 | — |
| soundtransit.org | · May 3, 2025 | — |
| valedolobo.com | · May 3, 2025 | — |
| edisoft.es | · May 3, 2025 | — |
| iycsa.com.co | · May 3, 2025 | — |
| mbmdubai.com | · Apr 11, 2025 | — |
| neatem.fr | Update! | · Feb 25, 2025 | — |
In the newsAll →
No articles mention this group yet.
Victim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .