CYBERSECURITYTRACKER
Incidents

Brain Cipher

Review this actor's tracked leak-site claims, published reporting, and attributed threat evidence.

ransomware136 leak-site claims, all timeLatest observed leak-site post 2026-11-04

Portable threat brief

Brain Cipher

Facts from stored data only; no AI-written text.

Opens the browser print dialog; choose Save as PDF.

Executive facts

Actor
Brain Cipher
Kind
ransomware
Actor record created
2026-07-01
Latest observed
2026-11-04
Leak-site claims
136
Catalogued techniques
0

Scope

Tracked sectors
Business & Professional Services, Healthcare, Financial Services, Manufacturing, Insurance
Claim records
2024-07-02 to 2026-11-04

Vulnerability events linked to this group

No dated vulnerability events are attached to this group's linked vulnerabilities.

Verified techniques

No verified ATT&CK mapping for this group.

Defensive actions

No defensive actions are attached to this profile.

Ransomware claim data is unverified: RansomLook (CC BY 4.0).

Most-claimed sectorsBusiness & Professional ServicesHealthcareFinancial ServicesManufacturingInsurance
Activity window in this site's data

This is only the dates observed by this site. It is not this actor's lifetime or evidence of dormancy outside these dates.

Claim records
First observed Latest observed
Verified ATT&CK phases represented

No verified ATT&CK mapping for this group

Origin and motivation

Origin and motivation not attributed.

No MITRE ATT&CK group mapping exists for this actor yet. Mappings here are strict: an actor links to a MITRE group only when the group's own name, aliases, or MITRE-published description match, and MITRE has not catalogued this group. Technique and defensive action data will appear automatically if a verified mapping lands.

Claims posted under this group's name or leak-site brand
136 on this site
View all on Breaches →
Leak-site claim activity

Claims per month, 2024-07 to 2026-11. Peak 14 in 2026-06.

2024-072026-11
Show monthly counts as a table
MonthClaims
2024-078
2024-086
2024-091
2024-104
2024-112
2024-127
2025-010
2025-024
2025-030
2025-041
2025-056
2025-060
2025-072
2025-081
2025-091
2025-105
2025-110
2025-120
2026-016
2026-022
2026-034
2026-048
2026-054
2026-0614
2026-079
2026-088
2026-0912
2026-1010
2026-1111

0 additional claims without a disclosure date

Ransomware claim data is unverified: RansomLook (CC BY 4.0).

Glossary