Ransomware Group

Braincipher

Brain Cipher emerged in July 2024. Both Windows and Linux variants are available. Brain Cipher using the leaked build of LockBit Black for their operations. The group suspected to have exploited CVE-2023-28252 (Microsoft Windows CLFS Driver Privilege Escalation Vulnerability). The Ransom demand ranges from $150,000 to $1,00,0000. Demand to be paid with Monero (XMR) cryptocurrency. In 2025, they have shifted their new Negotiation portal to new server with vanity TOR Domain starting with 'brain'.

Known victims90

Threat level

MEDIUM

Get an alert if one of your domains is named on a ransomware leak site.

Monitor your domainsFree account · up to 5 monitored targets

Known infrastructure

The following Tor hidden services have been associated with this group:

hv5on6i3k3g24qtu3ac6vtbrcgl2imz3sasakhfslhbnbqbcri73mqad.onion
x3nb7qcygpem2j5xzstyzdtgzofzkwkx4eko3ug4r73i6uhcgvyffjyd.onion
kxlw35vctxgbmwtz6474xwtkm2kywifg4efs6ixmvgdgbgi2uaurenid.onion
inzk64xcf3sm6qzkehmio7piwhkslhnab3rlviniyg7alcgsxvy7kcyd.onion
Brain Cipher Client Area

These sites are malicious. Open them only from an isolated environment.

Check if you’re affected

Look up your domain to see whether it appears on Braincipher’s victim list.

Try it nowFree⌘K

Try

risk score · threat categories · sources · age · confidence — in one request

Other active ransomware groups

LockBit ALPHV Blackcat CL0P Play BianLian Akira Medusa Rhysida