Loading threat actor…
BrainCipher is a ransomware and extortion threat actor active by at least 2024 and observed targeting organizations across multiple sectors and countries. The group operates a dedicated leak site and associated support infrastructure used for victim communications, negotiation, and controlled disclosure of stolen data. Reported victimology shows activity against organizations in the United States, Canada, the United Kingdom, Brazil, and Austria, including technology, manufacturing, healthcare, energy, telecommunications, and business services entities, as well as a U.S. state public-benefits environment. BrainCipher has been linked to data theft and public leaking of stolen information when ransom demands are not met. In the Rhode Island RIBridges intrusion, the group was reported to have accessed the environment through VPN credentials, remained present for months, conducted reconnaissance, moved laterally across multiple systems, escalated privileges, harvested credentials, maintained persistence with remote administration tooling, and exfiltrated sensitive data before disclosure on its leak platform. Reported tradecraft in that case included compromise of a domain controller and use of Image File Execution Options injection for privilege escalation. The actor’s infrastructure indicates an organized ransomware operation rather than ad hoc criminal activity. BrainCipher has been observed using a leak platform with FAQ and rules pages, segmented communication channels, and distributed storage nodes for exfiltrated data archives. Reporting also ties BrainCipher to double-extortion behavior and to a wiper component referred to as WipeBlack in activity associated with the broader LockBit ecosystem. BrainCipher has been described as a LockBit 3.0 variant in some reporting, indicating overlap or lineage with the LockBit ecosystem, but the precise organizational relationship is not fully established. The group is associated with ransomware attacks against healthcare providers in 2025, including Delta County Memorial Hospital and River Region Cardiology. Known aliases include brain_cipher.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
13 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
22 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
18 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Conducting a ransomware attack against windiam.com, a U.S.-based organization in the technology sector.
Listed only in the actor index/TTP section without substantive discussion.
Conducting a ransomware attack against iac-intl.com, a US-based organization in the business services sector.
Conducting a ransomware attack against robroy.com, a US-based manufacturing organization.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.