braincipher

BrainCipher is a ransomware threat actor and associated malware operation active by at least 2025 and 2026. It has been linked to attacks against organizations in multiple countries, including the United States, Brazil, Canada, and the United Kingdom, with observed victims spanning healthcare, manufacturing, technology, business services, and other sectors. Reported incidents indicate a financially motivated extortion model centered on data theft and ransomware deployment. BrainCipher has been described as a LockBit 3.0 variant or as activity tied to the broader LockBit ecosystem. Reporting has also associated BrainCipher-linked incidents with a wiper component known as WipeBlack, used to remove traces of the ransomware executable and hinder forensic recovery. This overlap suggests operational or tooling relationships with other LockBit-derived campaigns, although the precise organizational relationship is not fully established. Observed tradecraft includes double extortion, with data exfiltration preceding encryption, and selective targeting of high-value systems such as file servers and core infrastructure. In broader reporting tied to LockBit-related activity, associated operators have used rapid post-compromise escalation, lateral movement, credential and administrative abuse, and deployment patterns consistent with enterprise ransomware intrusions. BrainCipher has also been reported in connection with exploitation of CVE-2023-28252 in 2025. Known victims attributed to BrainCipher include healthcare entities such as Delta County Memorial Hospital and River Region Cardiology, alongside additional organizations in industrial, commercial, and professional services sectors. The actor is best characterized as a ransomware operation within or closely aligned to the LockBit-derived criminal ecosystem rather than a confirmed nation-state group. Known aliases are limited in the available reporting, with BrainCipher itself being the primary name in use.