Threat Group Profile
bravox
● Active — last 30 days
Victim claims
12
First seen
Apr 2026
Last activity
07 Jul 2026
Tracked since
Feb 2026
Group overview
BravoX is a selective ransomware-as-a-service operation that surfaced publicly in January 2026 after advertising on the RAMP underground forum, targeting primarily US-based organizations in healthcare and retail while applying strict affiliate vetting requirements including proof of access or a financial deposit.
Preferred targets
Technology · 3
Financial Services · 1
Agriculture and Food Production · 1
Manufacturing · 1
Healthcare · 1
Energy · 1
Most targeted countries
BR · 2
CA · 2
US · 2
CH · 1
TR · 1
MX · 1
