Threat Group Profile
bravox
● Active — last 30 days
Victim claims
18
First seen
Apr 2026
Last activity
17 Aug 2026
Tracked since
Feb 2026
Group overview
BravoX is a selective ransomware-as-a-service operation that surfaced publicly in January 2026 after advertising on the RAMP underground forum, targeting primarily US-based organizations in healthcare and retail while applying strict affiliate vetting requirements including proof of access or a financial deposit.
Preferred targets
Technology · 3
Healthcare · 2
Other · 2
Financial Services · 1
Retail & E-Commerce · 1
Manufacturing · 1
Most targeted countries
US · 3
CH · 2
BR · 2
CA · 2
IT · 2
GB · 2