BravoX is a selective ransomware-as-a-service operation launched in 2026 with strict affiliate vetting procedures.
Analyst brief
BravoX is a selective ransomware-as-a-service operation that surfaced in January 2026 via the RAMP underground forum. The group targets organizations in Italy, Switzerland, the US, UK, France, Brazil, and Canada, focusing on healthcare, retail, technology, energy, financial, and agriculture sectors. BravoX enforces strict affiliate vetting, requiring proof of access or a financial deposit, and deploys ransomware after gaining initial access. Defenders should focus on monitoring for TTPs associated with RAMP forum activity, securing initial access vectors, and watching for signs of data exfiltration prior to encryption in critical sectors.
bravox
activecrime
BravoX is a selective ransomware-as-a-service operation that surfaced publicly in January 2026 after advertising on the RAMP underground forum, targeting primarily US-based organizations in healthcare and retail while applying strict affiliate vetting requirements including proof of access or a financial deposit.