brain cipher
ransomware group · aka Brain Cipher, BrainCipher · unknown (no public attribution; researchers noted in 2024 that its encryptor is based on the leaked LockBit 3.0 builder) · active since 2024-06
Brain Cipher is a double-extortion ransomware group first observed in June 2024, when it attacked Indonesia's national data center (PDNS2) and disrupted immigration, customs, and other public services. Researchers have found its encryptor is based on the leaked LockBit 3.0 builder, but the group's origin, country, and leadership remain unknown. It operates an affiliate-style ransomware-as-a-service model with a Tor leak site and negotiation portal, and has claimed victims across government, aviation, professional services, and healthcare, including Argentina's EANA and JIAAC in 2024. Activity has continued at a steady pace through 2026, with this dashboard recording 8 victims in the last 30 days and 20 in the last 90 days as of its last post on 2026-08-31.
- Double extortion: encrypts systems and exfiltrates data, threatening publication on its Tor leak site
- Affiliate/RaaS-style operation with a Tor-based leak site and victim negotiation portal
- Uses an encryptor derived from the leaked LockBit 3.0 (LockBit Black) builder, per 2024 researcher analyses
- Initial access per incident is not consistently documented; in the 2024 Indonesia PDNS2 breach, Indonesian officials reported entry through an unpatched Sophos VPN, with CVE-2020-11899 cited in later analyses
- Multi-million-dollar demands scaled to large public-sector targets (about $8 million demanded in the 2024 Indonesia incident, per Reuters)
- Targets government and critical-infrastructure organizations alongside private firms; recent leak-site listings span professional services, healthcare, manufacturing, energy, and IT services
Indonesia National Data Center (PDNS2) - June 2024; disrupted immigration and other public services, EANA (Argentina's air navigation service provider) - 2024, JIAAC (Argentina's civil aviation accident investigation board) - 2024
No public figure.
Leak-site victims81 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| Pulmonary Physicians of South Florida Clinics | Data security breach! | · Feb 19, 2025 | — |
| neatem.fr | · Feb 17, 2025 | — |
| Cirion Technologies | · Feb 17, 2025 | — |
| It seems that it was easier to pay and calmly fix everything. | · Dec 23, 2024 | — |
| Modern Dental Group Limited | · Dec 17, 2024 | — |
| Estar Seguros, S.A. | · Dec 12, 2024 | — |
| Cristal y Lavisa S.A. de C.V. | · Dec 12, 2024 | — |
| Deloitte UK | · Dec 4, 2024 | — |
| Royce Corporation | · Dec 3, 2024 | — |
| G-ONE AUTO PARTS DE MÉXICO, S.A. DE C.V. | · Dec 2, 2024 | — |
| COOPERATIVA TELEFONICA DE CALAFATE LTD. | · Nov 13, 2024 | — |
| G-One Auto Parts de México S.A. de C.V. | · Nov 13, 2024 | — |
| Berridge Manufacturing Co. | · Oct 29, 2024 | — |
| K&S Tool & Mfg Co. | · Oct 28, 2024 | — |
| Basilio Advogados | · Oct 28, 2024 | — |
| CHRISTODOULOS G. VASSILIADES & CO. LLC | · Oct 28, 2024 | — |
| hanwa.co.th | · Sep 22, 2024 | — |
| rmn.fr | · Aug 28, 2024 | — |
| ghanare.com | · Aug 27, 2024 | — |
| beinlaw.co.il - Prof. Bein & Co. | · Aug 21, 2024 | — |
| tiendasmacuto.com | · Aug 17, 2024 | — |
| fabamaq.com | · Aug 12, 2024 | — |
| cyceron.fr | · Aug 12, 2024 | — |
| Sherbrooke Metals | · Jul 25, 2024 | — |
| Apex Global | Big leak outlooks - 2tb. | · Jul 25, 2024 | — |
| Cole Technologies Group | · Jul 25, 2024 | — |
| Family Wealth Advisors Ltd. | · Jul 25, 2024 | — |
| Mars 2 LLC | · Jul 25, 2024 | — |
| Kominfo - 2 | · Jul 3, 2024 | Very expensive advertising. |
| Your advertisement | · Jul 3, 2024 | Space for your advertising. |
| Kominfo | · Jul 2, 2024 | More important than money, only honor. |
In the newsAll →
No articles mention this group yet.