Brain Cipher emerged in July 2024. Both Windows and Linux variants are available. Brain Cipher using the leaked build of LockBit Black for their operations. The group suspected to have exploited CVE-2023-28252 (Microsoft Windows CLFS Driver Privilege Escalation Vulnerability). The Ransom demand ranges from $150,000 to $1,00,0000. Demand to be paid with Monero (XMR) cryptocurrency. In 2025, they have shifted their new Negotiation portal to new server with vanity TOR Domain starting with 'brain'.
Genera un perfil del actor con IA (defensivo) cuando lo pidas.
Este grupo no tiene TTPs curadas. Puedes generar un mapeo MITRE ESTIMADO por IA (no confirmado) a partir de su descripción/notas, solo cuando lo pidas.
Para detección/bloqueo en tu EDR/SIEM. Fuente: ransomware.live.
Firma de detección defensiva para este grupo (úsala en tu EDR/SIEM). Fuente: ransomware.live.
/*
BrainCipher ransomware (LockBit 3.0 variant)
*/
rule BrainCipher_Ransomnote
{
meta:
author = "ransomware.live"
family = "ransomware.braincipher"
description = "Detects BrainCipher ransomware ransom note"
date = "2026-05-04"
severity = 7
score = 70
strings:
$s1 = "BrainCipher" ascii nocase
$s2 = "BRAINCIPHER" ascii
$s3 = "braincipher.onion" ascii nocase
condition:
any of them
}
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
\\\\\\Welcome to Brain Cipher Ransomware!\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
\\\\\\\\\Dear managers!\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
\\\\\\\\\\If you're reading this, it means your systems have been hacked and encrypted and your data stolen.\\\\\\\\\\\\\\\\\\\\\\\\\
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
\\\\\\\\\\\\The most proper way to safely recover your data is through our support. We can recover your systems within 4-6 hours.\\\\\\
\\\\\\\\\\\\\In order for it to be successful, you must follow a few points:\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
\\\\\\\\\\\\\\\1.Don't go to the police, etc.\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
\\\\\\\\\\\\\\\\2.Do not attempt to recover data on your own.\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
\\\\\\\\\\\\\\\\\3.Do not take the help of third-party data recovery companies.\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
\\\\\\\\\\\\\\\\\\\\\\\In most cases, they are scammers who will pay us a ransom and take a % for themselves.\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
\\\\\\\\\\\\\\\\\\\\If you violate any 1 of these points, we will refuse to cooperate with you!!!\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
\\
\\ ATTENTION!!! If you do not contact us within 48 hours, we will post the record on our website:
\\
\\
\\ [redactado]
\\
\\
\\
\\ 3 steps to data recovery:
\\
\\
\\ 1. Download and install Tor Browser ([redactado]
\\
\\ 2. Go to our support page: [redactado]
\\ ******* This page can take up to 30 minutes to load.
\\
\\ 3. Enter your encryption ID: [snip]
\\
\\
\\ Email to support: [redactado]
\\
\\
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
_ _
| | (_)
| |__ _ __ __ _ _ _ __
| '_ \| '__/ _` | | '_ \
| |_) | | | (_| | | | | |
|_.__/|_| \__,_|_|_| |_|
,--""-.
(_,=- )
`---#{
`} [AI generated] N/A
[AI generated] Rob Roy Industries, operating through robroy.com, is a US-based manufacturer specializing in electrical conduit systems and enclosures. The company produces PVC-coated steel conduit, fiberglass conduit, and industrial enclosures used in corrosive and hazardous environments. Headquartered in Verona, Pennsylvania, Rob Roy serves industries such as oil and gas, chemical processing, wastewater treatment, and utilities, providing durable electrical protection solutions across North America.
| Organización | País | Sector | Grupo | Descubierta |
|---|---|---|---|---|
| windiam.com | BE | Technology | — | 22 jul 2026 |
| robroy.com | US | Manufacturing | — | 9 jul 2026 |
| iac-intl.com | US | Business Services | — | 9 jul 2026 |
| digitaldynamics.com | US | Technology | — | 1 jul 2026 |
| goldenstateortho.com | US | Healthcare | — | 1 jul 2026 |
| printronix.com | US | Manufacturing | — | 1 jul 2026 |
| paipharma.com | BR | Healthcare | — | 30 jun 2026 |
| eggetttax.ca | CA | Agriculture and Food Production | — | 22 jun 2026 |
| sterlinggloballtd.com | GB | Business Services | — | 22 jun 2026 |
| themintgaming.com | Consumer Services | — | 19 jun 2026 | |
| alu-rex.com | AT | Manufacturing | — | 15 jun 2026 |
| anglomoil.com | GB | Energy | — | 15 jun 2026 |
| squamish.net | CA | Not Found | — | 1 jun 2026 |
| iycsa.com.co | CO | Other | — | 5 may 2025 |
| Estar Seguros, S.A. | MX | Financial Services | — | 12 dic 2024 |
| Cristal y Lavisa S.A. de C.V. | MX | Manufacturing | — | 12 dic 2024 |
| G-ONE AUTO PARTS DE MÉXICO, S.A. DE C.V. | MX | Manufacturing | — | 2 dic 2024 |
| COOPERATIVA TELEFONICA DE CALAFATE LTD. | AR | Professional Services | — | 13 nov 2024 |
| G-One Auto Parts de México S.A. de C.V. | MX | Manufacturing | — | 13 nov 2024 |
| Basilio Advogados | BR | Professional Services | — | 28 oct 2024 |
| tiendasmacuto.com | VE | Professional Services | — | 17 ago 2024 |
| fabamaq.com | AR | Manufacturing | — | 12 ago 2024 |
Las direcciones de los sitios de filtración (.onion) se conocen pero no se publican ni se enlazan. Solo se muestran metadatos públicos. ética
[AI generated] N/A
[AI generated] N/A
[AI generated] Golden State Ortho appears to be an orthopedic medical practice or orthopedic supply company based in the United States, likely California given the "Golden State" reference. It operates in the healthcare industry, potentially offering orthopedic surgical services, prosthetics, orthotics, or related medical products and patient care. Specific verified details about this company are limited, so full operational details cannot be confirmed with certainty.
[AI generated] Printronix is a US-based company specializing in industrial printing solutions. Founded in 1974 and headquartered in Irvine, California, it manufactures line matrix printers, thermal printers, and related accessories primarily for enterprise and industrial environments. Its products serve industries such as manufacturing, logistics, and supply chain management, offering high-volume, mission-critical printing capabilities used in warehouses and distribution centers worldwide.