Dark Web Profile: BravoX Ransomware

Keypoints

• BravoX publicly appeared on January 23, 2026 by publishing a Tor address on the RAMP forum and shortly afterward deploying a TOR-based data leak site (DLS).
• The group’s DLS lists three alleged victims located in the United States, including two healthcare organizations and one retail organization.
• BravoX markets itself as a selective RaaS operation with strict affiliate requirements: proof of access to unpublished data from targets with >$5M revenue, a financial deposit on another forum, or trusted recommendations.
• The operator emphasizes secrecy, proof-based extortion, and non-engagement with CIS-based targets—phrasing similar to Russian-speaking ransomware groups and likely intended as signaling.
• Current activity is low-volume and early-stage, suggesting the group is focused on reputation-building and selective disclosures rather than large-scale campaigns.
• SOCRadar monitoring and Threat Actor Intelligence enable continuous visibility into BravoX’s TOR-based leak site, affiliate recruitment posts, forum registrations, and potential infrastructure reuse or links to other actors.