BravoX — Ransomware Profile
BravoX is a selective ransomware-as-a-service operation that surfaced publicly in January 2026 after advertising on the RAMP underground forum, applying strict affiliate vetting requirements including proof of access or a financial deposit. Its first victims were North American organizations in healthcare and retail, but its focus has since shifted towards Europe, including companies in Switzerland, and towards the finance and legal sectors. The group prohibits attacks on organizations in CIS countries.
IntelFusions coverage (1)
Tools & malware
- NetScan Network Reconnaissance
- ProtonVPN Anonymization Tool
- Rclone Exfiltration Tool
- wsftprm.sys Vulnerable Driver
Recent claimed victims
Vendor research
Read the full analysis on IntelFusions