bravox
Known ransomware group ACTIVE Currently active
BravoX is a selective ransomware-as-a-service operation that surfaced publicly in January 2026 after advertising on the RAMP underground forum, targeting primarily US-based organizations in healthcare and retail while applying strict affiliate vetting requirements including proof of access or a financial deposit.
4
Total Claims
2
Critical
—
Records Claimed
2
Industries Hit
Active span: May 7, 2026 – Oct 22, 2026 · 4 organizations targeted
Currently active
Actor Threat Profile
Activity Timeline
Peak: May 2026 (3)May 2026
LessMore
Oct 2026Share this profile
Top Targeted Industries
Healthcare 1
Energy 1
Tradecraft & Infrastructure
0
Documented tools
0 / 0
MITRE tactics / techniques
2
Known leak sites
Targeted Organizations
Claims by bravox
Low
Ransomware Claim: AMSAM
AMSAM
bravox
Ransomware
Oct 23, 2026 Critical
Ransomware Claim: AcademyHealth
AcademyHealth
bravox
Ransomware Healthcare
Jun 1, 2026 Critical
Ransomware Claim: Emek Elektrik
Emek Elektrik
bravox
Ransomware Energy
May 24, 2026 Low
Ransomware Claim: Soprolux
Soprolux
bravox
Ransomware
May 8, 2026