Ransomware Group
Bravox
BravoX is a selective ransomware-as-a-service operation that surfaced publicly in January 2026 after advertising on the RAMP underground forum, targeting primarily US-based organizations in healthcare and retail while applying strict affiliate vetting requirements including proof of access or a financial deposit.
Known victims31
Threat level
MEDIUM
Get an alert if one of your domains is named on a ransomware leak site.
Monitor your domainsFree account · up to 5 monitored targets
Known infrastructure
The following Tor hidden services have been associated with this group:
Verification RequiredVerification Required
These sites are malicious. Open them only from an isolated environment.
Check if you’re affected
Look up your domain to see whether it appears on Bravox’s victim list.
Try it nowFree⌘K
Try
risk score · threat categories · sources · age · confidence — in one request