Parsing: enabled
Description
Brain Cipher ransomware surfaced in mid-2024, rapidly gaining notoriety after a high-impact attack on Indonesia’s National Data Center, which disrupted over 160 government services including immigration systems. The group operates with a double-extortion model, encrypting data using a LockBit 3.0-based payload (Salsa20/RSA hybrid) and threatening leaks via a Tor-hosted portal. Distinct behaviors include encrypting both file contents and filenames, and customizing encrypted file names with appended random extensions. Initial access methods include phishing and purchases from initial-access brokers. Ransom demands have ranged from tens of thousands up to $8 million USD, though victims have sometimes been offered decryption keys without payment. Victims span sectors such as government, healthcare, education, media, and manufacturing across Southeast Asia, Europe, and the Americas.
External Analysis6
| External Analysis |
|---|
| https://www.sentinelone.com/anthology/brain-cipher/ |
| https://www.watchguard.com/wgrd-security-hub/ransomware-tracker/brain-cipher |
| https://www.vectra.ai/modern-attack/threat-actors/brain-cipher |
| https://www.group-ib.com/masked-actors/brain-cipher/ |
| https://wazuh.com/blog/detecting-brain-cipher-ransomware-with-wazuh/ |
| https://www.reuters.com/technology/cybersecurity/indonesia-says-it-has-begun-recovering-data-after-major-ransomware-attack-2024-07-12/ |
Mail3
| brain.support@cyberfear.com |
| brain.dataleak@cyberfear.com |
| brain.decrypt@cyberfear.com |
Urls2
| Url | ||||
|---|---|---|---|---|
| http://mybmtbgd7aprdnw2ekxht5qap5daam2wch25coqerrq2zdioanob34ad.onion/ | Down |
|
||
| http://vkvsgl7lhipjirmz6j5ubp3w3bwvxgcdbpi3fsbqngfynetqtw4w5hyd.onion/ | Up |
|
File servers34
| Url | ||||
|---|---|---|---|---|
| http://cuuhrxbg52c5agytmtjpwfu7mrs4xtaitc4mukkiy2kqdxeqbcmuhaid.onion/ | Down | |||
| http://4ldgw2wuidqu5ef3rzx4byonf3y7rdnh43jiw2z4sbtjiwic6gkov7yd.onion/c/lgc2Yxua65agt4XMOMkQKJjsdrV2IzYk | Down |
|
||
| http://4ldgw2wuidqu5ef3rzx4byonf3y7rdnh43jiw2z4sbtjiwic6gkov7yd.onion/ | Down |
|
||
| http://zktnif5vckhmz5tyrukp5bamatbfhkxjnb23rspsanyzywcrx3bvtqad.onion/ | Down |
|
||
| http://yt7beb7fj6xbh4dndrlyvl3gn4ck36qn2oqheiqjs4bp3wspj3wgpcad.onion/ | Down |
|
||
| http://i6b4r6blgmm3r62zj42qxn6bvcbcrslcg6b6uwqws6xhnxz2howbhkid.onion/ | Down |
|
||
| http://pzghjpkm2liszmvjsttflp475zqxgrywjhr7xagc4bqfb2a7aw3qysyd.onion/ | Down |
|
||
| http://5v6tgs5xyuvl7kpg5b26e54kddlxdvktep2qmglawrohksv3qjwvw7qd.onion/ | Down |
|
||
| http://lhdv4ydjx5idzvntdrmcbwsh3dhdi3ww5hoz3ws2d5q5jlfewdacx4qd.onion/ | Down |
|
||
| http://oe7kcuvnulmdzir6zkewv5p353kc7qjf5tyqxfxabhzsm26pji44elqd.onion/ | Down |
|
||
| http://zv27q4tjvqxelm2imgztfg7gtl3v56oqabe77hiufqoqilis2dgcdsad.onion/ | Down |
|
||
| http://ubetdhmgnry4jk7ya7gh7p4hm4c3c57srkw62oc6hjmvvvkrqeybjjid.onion/ | Down |
|
||
| http://ixvarmokkir6t6fzpn7prussp3ulys66aeivrhcvrmfowqi2gi2fgryd.onion/ | Down |
|
||
| http://tahr6kwobsi7fj5j3hoyzxr34ipyiyuv2svhteht5td4etq23bcx7tyd.onion/ | Down |
|
||
| http://ncyg34lipi3w2u7yvxl3swr6wj6lsoeix3grrdsn6nmcv4r7vntanoid.onion/ | Down |
|
||
| http://bgpeqy3d5svuikeaueitix6zosg3pzekw77viulnucsiqsn4sjr65iyd.onion/ | Down |
|
||
| http://as7fbsjvifse52ek5qnptfgvkduvvnl56adb3jjgk6k3p7bisipvotyd.onion/ | Down |
|
||
| http://xangddavm54rgsju7iceahxztbqrcflzunffwbaswwhhftieygc4j3ad.onion/ | Down |
|
||
| http://q226mkoikzgyu33jin7ox3qo6tea7yhlgz52p5lslpj73edtocsz4wqd.onion/ | Down |
|
||
| http://hdgfvxxkepllbvqvk7vrudgwq55tg4joo4xpajaa3nv5gzpake66bnid.onion/ | Down |
|
||
| http://jgkgqztfmwk53wlttsjo6i3nmwtzoch2oi2bocqzb4zmp6kfspuiaead.onion/ | Down |
|
||
| http://zke5xim35cfolmq2h5i5sfmcoxr4pbpkfjwtq5lf6o4zo7avfcvnb5qd.onion/ | Down |
|
||
| http://3frnhzcnlkjnw5q3tm6elzizinm2k3bmrtf2xwqjzpcxzeqwn2tv6wyd.onion/ | Up |
|
||
| http://6ft2dfh26wm3w44orpjcgviutvfp25ez2iyh5ego5egvfmifrws7vvqd.onion/ | Up |
|
||
| http://zijgmuqjzb6dc7pofxhtaiz36qqyg35lhutybmzaz6whzgei2casjgid.onion/ | Up |
|
||
| http://inzk64xcf3sm6qzkehmio7piwhkslhnab3rlviniyg7alcgsxvy7kcyd.onion/ | Up |
|
||
| http://upiqcdsgvh6v5owteasjzyxbj2xug574dj4fctthehd7zjq7wmuxbwqd.onion/ | Up |
|
||
| http://psv5ejeysrncs6ltu4pkjyazswcmw3atmxi4eg44a6luudin5ufchcqd.onion/ | Up |
|
||
| http://lhsxojxowgtwdqlryl72d2v5cpgqv3sll4d47yyqdisersigvfbl5uid.onion/ | Up |
|
||
| http://mejouwrwja4iou7myj34rqi7cixyhn7vsa42e2n2dhxzc5mmkiaki3yd.onion/ | Up |
|
||
| http://3fg2gfwrdks46drwvejpgpak5klrflclsjjo35dxtqfk3poeez6oezad.onion/ | Up |
|
||
| http://emdnfl2fv32jhssxcbxlo6dzg2at4d7qbw2md6inz63qzdfgyln5cwyd.onion/ | Up |
|
||
| http://a4vbe7yp4kluped6khuhpr5nmzshiimx2jt5j22ozriiq6ngsm3fcpyd.onion/ | Up |
|
||
| http://x3nb7qcygpem2j5xzstyzdtgzofzkwkx4eko3ug4r73i6uhcgvyffjyd.onion/ | Up |
|
Chat servers3
| Url | ||||
|---|---|---|---|---|
| http://p6wmotxzvg34tdmpwm4beqgrcyp5iys43snkccsahnw74la3k3xx6pad.onion | Down |
|
||
| http://brain4zoadgr6clxecixffvxjsw43cflyprnpfeak72nfh664kqqriyd.onion/ | Down |
|
||
| http://braincgksuixxkpkme7zlpkh7u47oryxx574d74ws4eal4t2mxyahbqd.onion | Down |
|
Activity (interactive) 66
Posts66
| Date | Title | Description | Screen |
|---|---|---|---|
| sterlinggloballtd.com | We have 100gb files and documents. If you think you are here by mistake, please contact us at brain.dataleak@cyberfear.com |
|
|
| eggetttax.ca | 330,000 documents and files of this company, with a total size of over 250 GB. If you think you are here by mistake, please contact us at brain.dataleak@cyberfear.com |
|
|
| themintgaming.com | Once the timer runs out, we will publish the latest Oasis 360 by Aristocrat database belonging to The Mint Gaming Hall, which contains the personal data of more than 250,000 player... |
|
|
| anglomoil.com | We have more than 100 thousand documents from Anglomoil, Avantage Global and Avantage Marine Group, whose director is Victor Prasad. If you think you are here by mistake, please co... |
|
|
| alu-rex.com | We have 150gb files and documents. If you think you are here by mistake, please contact us at brain.dataleak@cyberfear.com |
|
|
| squamish.net | We have a lot of confidential documents. If you think you are here by mistake, please contact us at brain.dataleak@cyberfear.com |
|
|
| sheppadviser.com.au | We have more 350GB of data. If you think you are here by mistake, please contact us at brain.dataleak@cyberfear.com |
|
|
| ice.org.uk | We have more 1TB of data. If you think you are here by mistake, please contact us at brain.dataleak@cyberfear.com |
|
|
| bridgeway-consulting.co.uk | We have 500GB of data. If you think you are here by mistake, please contact us at brain.dataleak@cyberfear.com |
|
|
| soundinsurance.ca | We have 500GB of data. If you think you are here by mistake, please contact us at brain.dataleak@cyberfear.com |
|
|
| endeavourautomotive.co.uk | We have 150GB of data. If you think you are here by mistake, please contact us at brain.dataleak@cyberfear.com |
|
|
| eworldme.com | We have 300GB of data. If you think you are here by mistake, please contact us at brain.dataleak@cyberfear.com |
|
|
| liteline.com | We have 350GB of data. If you think you are here by mistake, please contact us at brain.dataleak@cyberfear.com |
|
|
| westonconsulting.com | We have 800GB of data. If you think you are here by mistake, please contact us at brain.dataleak@cyberfear.com |
|
|
| exceldor.ca | We have about 1.5 TB of data from the company's servers. We will publish some of it in the near future. If you think you are here by mistake, please contact us at brain.dataleak@cy... |
|
|
| flbgroup.com |
|
||
| kisnet.co.jp |
|
||
| nwlr.ca |
|
||
| fsbgroup.ca |
|
||
| semag.fr |
|
||
| axxia.fr |
|
||
| oxfordcounty.ca |
|
||
| cdom.org |
|
||
| bmsi.org |
|
||
| bw-lv.de |
|
||
| VIRTUALWEB.US |
|
||
| jorgefernandez.es |
|
||
| ddecor.com |
|
||
| ruizre.es |
|
||
| soundtransit.org |
|
||
| valedolobo.com |
|
||
| edisoft.es |
|
||
| iycsa.com.co |
|
||
| mbmdubai.com |
|
||
| neatem.fr | Update! |
|
||
| Pulmonary Physicians of South Florida Clinics | Data security breach! |
|
||
| neatem.fr |
|
||
| Cirion Technologies |
|
||
| It seems that it was easier to pay and calmly fix everything. |
|
||
| Modern Dental Group Limited |
|
||
| Estar Seguros, S.A. |
|
||
| Cristal y Lavisa S.A. de C.V. |
|
||
| Deloitte UK |
|
||
| Royce Corporation |
|
||
| G-ONE AUTO PARTS DE MÉXICO, S.A. DE C.V. |
|
||
| COOPERATIVA TELEFONICA DE CALAFATE LTD. |
|
||
| G-One Auto Parts de México S.A. de C.V. |
|
||
| Berridge Manufacturing Co. |
|
||
| K&S Tool & Mfg Co. |
|
||
| Basilio Advogados |
|
||
| CHRISTODOULOS G. VASSILIADES & CO. LLC |
|
||
| hanwa.co.th |
|
||
| rmn.fr |
|
||
| ghanare.com |
|
||
| beinlaw.co.il - Prof. Bein & Co. |
|
||
| tiendasmacuto.com |
|
||
| fabamaq.com |
|
||
| cyceron.fr |
|
||
| Sherbrooke Metals |
|
||
| Apex Global | Big leak outlooks - 2tb. |
|
||
| Cole Technologies Group |
|
||
| Family Wealth Advisors Ltd. |
|
||
| Mars 2 LLC |
|
||
| Kominfo - 2 | Very expensive advertising. |
|
|
| Your advertisement | Space for your advertising. |
|
|
| Kominfo | More important than money, only honor. |
|