Watch Floor
Ransomware

brain cipher

0mentions, 7 days
0mentions, 30 days
21victims posted, 30 days
nonelast mentioned

CVEs in recent coverage

No CVEs named alongside this actor in the last 90 days.

Recent victims

  • hhjcpa.com
    Nov 4, 2026
  • fbc.ca
    Nov 4, 2026
  • hamiltonhealthcenter.com
    Nov 4, 2026
  • spearcenter.com
    Nov 4, 2026
  • myronl.com
    Nov 4, 2026
  • megastarfinancial.com
    Nov 4, 2026
  • prairieridge.net
    Nov 4, 2026
  • parkell.com
    Nov 4, 2026
  • ciscocems.com
    Nov 4, 2026
  • tritonclaims.com
    Nov 4, 2026
  • cadorath.com
    Nov 4, 2026
  • novagroupgbc.com
    Oct 21, 2026
  • oflaherty-law.com
    Oct 21, 2026
  • clinicaromero.com
    Oct 21, 2026
  • sodali.com
    Oct 21, 2026
  • srsnodgrass.com
    Oct 21, 2026
  • prosomnus.com
    Oct 21, 2026
  • olyortho.com
    Oct 21, 2026
  • mvjllp.com
    Oct 21, 2026
  • Trailerbridge.com
    Oct 12, 2026
  • huntcompanies.com
    Oct 9, 2026

A leak-site post is the group's claim, not confirmed by the victim.

Recent activity

No posts or advisories have named this actor recently.

References

From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.