Ransomware group profile · #126 by claimed victims

Bravox ransomware

BravoX is a selective ransomware-as-a-service operation that surfaced publicly in January 2026 after advertising on the RAMP underground forum, targeting primarily US-based organizations in healthcare and retail while applying strict affiliate vetting requirements including proof of access or a financial deposit.

Active First seen Feb 2026

40Victims claimed on leak sites

10Victims in the last 30 days

18Victims in the last 90 days

11Countries hit

2Leak-site URLs tracked, 0 online

22 Oct 2026Latest claim recorded

Victimology

Who Bravox claims to have breached, from 40 leak-site posts recorded by VULONE.

Claims per month last 12 months

Top sectors

Healthcare5

Technology5

Professional Services4

Other4

Financial Services3

Energy & Utilities2

Manufacturing2

Agriculture and Food Production2

Top countries

United States11

France5

Switzerland4

Canada3

Brazil2

Germany2

United Kingdom2

Italy2

Latest claimed victims 12 most recent

Victim	Sector	Country	Claimed
AMSAM 🇫🇷	-	-	22 Oct 2026
Barrow & Grimm 🇺🇸	-	-	22 Oct 2026
AMSAM amsam.net	Not Found	FR	22 Oct 2026
Barrow & Grimm barrowgrimm.com	Not Found	US	22 Oct 2026
GSE-M Technology Sdn. Bhd. 🇲🇾	-	-	21 Oct 2026
GSE-M Technology Sdn. Bhd. gse.com.my	Technology	MY	21 Oct 2026
Minkon 🇩🇪	-	-	17 Oct 2026
Minkon minkon-international.com	Not Found	DE	16 Oct 2026
Dudley Land Company 🇺🇸	-	-	9 Oct 2026
Dudley Land Company dudley-land.com	Other	US	9 Oct 2026
TOWILL 🇺🇸	-	-	20 Sep 2026
TOWILL towill.com	Technology	US	20 Sep 2026

All 40 Bravox victims, searchable

Full victim list with claim posts, domains, timing and exports, plus the negotiation chats and leak-site screenshots VULONE archives for this crew.

Start free Sign in

Tactics, techniques and procedures

ATT&CK technique mapping for Bravox is in progress. Victimology, infrastructure status and leak-site tracking are live above.

Indicators, detections and the full playbook

Hashes, C2 addresses, onion services, Sigma and YARA detections per technique, and the negotiation transcripts are available to signed-in analysts.

See full IOCs

Frequently asked

Is Bravox ransomware still active?

Bravox is tracked as active. The most recent leak-site claim VULONE recorded is dated 22 October 2026. 10 victims were claimed in the last 30 days.

How many victims has Bravox claimed?

VULONE has recorded 40 leak-site victim claims attributed to Bravox since February 2026, across 11 countries and 10 sectors.

Which industries does Bravox target?

The sectors most often named on the Bravox leak site are Healthcare, Technology, Professional Services.

Which countries are most affected by Bravox?

Most Bravox victims recorded by VULONE are located in United States, France, Switzerland.

Where does VULONE get Bravox victim data?

Claims are collected continuously from the group's own leak sites and cross-checked with ransomware.live and RansomLook. A claim is the group's assertion, not a confirmed breach.

Other ransomware groups

Victim claims are collected from leak sites and enrichment partners (ransomware.live, RansomLook) and represent the group's own assertions, not confirmed breaches. Profile last updated 31 October 2026. Questions or corrections: research@vulone.com.