bravox
Known ransomware group ACTIVE Currently active
BravoX is a selective ransomware-as-a-service operation that surfaced publicly in January 2026 after advertising on the RAMP underground forum, targeting primarily US-based organizations in healthcare and retail while applying strict affiliate vetting requirements including proof of access or a financial deposit.
3
Total Claims
2
Critical
—
Records Claimed
2
Industries Hit
Active span: May 7, 2026 – May 29, 2026 · 3 organizations targeted
Currently active
Actor Threat Profile
Activity Timeline
Peak: May 2026 (3)May 2026
LessMore
May 2026Share this profile
Top Targeted Industries
Healthcare 1
Energy 1
Tradecraft & Infrastructure
0
Documented tools
0 / 0
MITRE tactics / techniques
2
Known leak sites