BravoX ransomware

BravoX is a ransomware-as-a-service brand that surfaced on underground forums in late 2025 and began naming victims in January 2026. A compromised host shows a text file called 00_Recovery_notes.txt stating that data was both copied and locked, with a four-day window to open talks through a Tor chat that requires the victim to register using a supplied token. Early leak-site entries were North American healthcare and retail firms; later activity shifted toward Europe, including Swiss finance and legal organisations. Intrusions examined by responders began with stolen VPN credentials, followed by new domain-admin accounts, RDP movement and attempts to disable endpoint defences. No tie to an earlier family has been established, and the suffix given to encrypted files has not been published.

Ransom note filenames: 00_Recovery_notes.txt

Decryptor: Decryptor availability has not been recorded.