Brain Cipher
Brain Cipher ransomware surfaced in mid-2024, rapidly gaining notoriety after a high-impact attack on Indonesia’s National Data Center, which disrupted over 160 government services including immigration systems. The group operates with a double-extortion model, encrypting data using a LockBit 3.0-based payload (Salsa20/RSA hybrid) and threatening leaks via a Tor-hosted portal. Distinct behaviors include encrypting both file contents and filenames, and customizing encrypted file names with appended random extensions. Initial access methods include phishing and purchases from initial-access brokers. Ransom demands have ranged from tens of thousands up to $8 million USD, though victims have sometimes been offered decryption keys without payment. Victims span sectors such as government, healthcare, education, media, and manufacturing across Southeast Asia, Europe, and the Americas.
Most affected countries
- United States3
- Spain2
- Canada1
- Netherlands1
Most affected sectors
- Other7
- Professional services5
- Finance & insurance3
- Transport & logistics2
- Healthcare2
- Technology2
- Construction1
- Education1
Recent victims
| Organisation | Country | Sector | Claimed | Status |
|---|---|---|---|---|
| Trailerbridge | United States | Transport & logistics | 9/29/2026 | ◌ Claimed (unverified) |
| McCord Claims | United States | Professional services | 9/29/2026 | ◌ Claimed (unverified) |
| Goriteway | — | Education | 9/29/2026 | ◌ Claimed (unverified) |
| Northeast Rehab | — | Healthcare | 9/29/2026 | ◌ Claimed (unverified) |
| Mulholland | — | Transport & logistics | 9/29/2026 | ◌ Claimed (unverified) |
| Wildman | — | Other | 9/29/2026 | ◌ Claimed (unverified) |
| Maxwell Group | — | Finance & insurance | 9/29/2026 | ◌ Claimed (unverified) |
| Latitude Subroación | — | Finance & insurance | 9/29/2026 | ◌ Claimed (unverified) |
| Gold Star Financial | United States | Finance & insurance | 9/23/2026 | ◌ Claimed (unverified) |
| Hoyle Tanner | — | Professional services | 9/17/2026 | ◌ Claimed (unverified) |
| AECOM | — | Construction | 9/17/2026 | ◌ Claimed (unverified) |
| Xpera | Canada | Technology | 9/17/2026 | ◌ Claimed (unverified) |
| Ahadandco | — | Other | 8/31/2026 | ◌ Claimed (unverified) |
| Sago | — | Other | 8/31/2026 | ◌ Claimed (unverified) |
| CR Meyer | — | Other | 8/31/2026 | ◌ Claimed (unverified) |
| CCS Perfusion | — | Healthcare | 8/31/2026 | ◌ Claimed (unverified) |
| ICOT | Spain | Technology | 8/31/2026 | ◌ Claimed (unverified) |
| AEI Consultants | — | Professional services | 8/31/2026 | ◌ Claimed (unverified) |
| SYC | Spain | Professional services | 8/31/2026 | ◌ Claimed (unverified) |
| Adviesbureau De Beuckelaer BV | Netherlands | Professional services | 8/31/2026 | ◌ Claimed (unverified) |
| Windiam | — | Other | 7/22/2026 | ◌ Claimed (unverified) |
| robroy | — | Other | 7/9/2026 | ◌ Claimed (unverified) |
| IAC International | — | Other | 7/9/2026 | ◌ Claimed (unverified) |
Claims are published by the criminal groups themselves and are unverified until the organisation or the press confirms them. Names of natural persons (sole traders, individual professionals) are anonymised under the GDPR. We never link to leak sites or stolen data. To request the removal or anonymisation of an entry, contact the site administrator.
Sources: RansomLook (CC BY 4.0), MITRE ATT&CK®, MISP Galaxy, Google News.