Dark Web Profile: BravoX Ransomware

BravoX is described as a newly observed ransomware operation that surfaced publicly on 23 January 2026 after publishing a Tor address on the RAMP forum, with a dedicated data leak site identified soon after. The group is presented as a ransomware-as-a-service operation with an affiliate-driven model, advertising secrecy, proof-based extortion, and a stance against CIS-based targets.

At the time of analysis, BravoX’s data leak site lists three alleged victims, all in the United States, comprising two healthcare organisations and one retailer, indicating a low but targeted initial victim set. The article notes the threat actor registered on RAMP in September 2025 and that activity remains limited, suggesting early-stage operations focused on credibility rather than large-scale victimisation.

According to SOCRadar, monitoring of BravoX through dark web and threat actor intelligence modules helps track its leak site structure, affiliate recruitment content, and potential links to other ransomware ecosystems as the operation evolves. In short, BravoX is viewed as a developing, low-volume RaaS brand still refining its model, with ongoing visibility needed to assess future growth and impact.