BRAINCIPHER Ransomware: 3 New Victims in 24 Hours — Professional Services & Tech Sector Targeting With Detection Rules

Classification: TLP:CLEAR | Publication Date: 2026-09-18 | Source: ransomware.live dark web leak site monitoring | Analyst: Security Arsenal Threat Intelligence

Executive Summary

Security Arsenal's dark web collection infrastructure confirmed three new victim postings on BRAINCIPHER's .onion leak site within a single 24-hour window (2026-09-17). The cluster — hoyletanner.com (GB), aecom.com (US), and xpera.ca (CA) — indicates an active campaign wave against professional services and technology organizations in anglophone Western markets. The simultaneity of the postings suggests either batch detonation following a shared initial-access vector, or a coordinated leak-site publishing schedule designed to maximize reputational pressure. Organizations in engineering, consulting, architecture, and managed technology services should treat this as an active-threat notification.

Threat Actor Profile — BRAINCIPHER

Analyst Note: Because BRAINCIPHER payloads are built on the leaked LockBit 3.0 codebase, detection content written for LockBit affiliate TTPs (defense evasion via vssadmin, network share enumeration, self-spreading via Group Policy in large intrusions) has high transfer value against this group.

Current Campaign Analysis

Victimology

• Sector concentration: 2 of 3 victims sit in professional services (engineering/consulting), 1 in technology. This mirrors BRAINCIPHER's historical preference for project-driven firms holding client intellectual property — CAD files, bid documents, infrastructure designs — which carry high extortion leverage because disclosure harms the victim's clients, not just the victim.
• Geography: GB/US/CA only. No non-anglophone victims in this wave, consistent with English-language negotiation operations.
• Victim size: Mid-market to enterprise. Revenue estimates range from ~$20M (boutique consulting) to multi-billion-dollar enterprise (AECOM-scale). The spread indicates opportunistic access-vector-driven targeting rather than a single vertical playbook — the gang is monetizing whatever edge-device footholds its access pipeline yields.
• Posting cadence: 3 postings in one day against a trailing baseline of ~3 per 100-post window period suggests a burst pattern: multiple intrusions matured simultaneously, likely seeded weeks apart via a common vector.

Probable Initial Access Vector Correlation

The following CISA KEV entries with confirmed ransomware use align with BRAINCIPHER's known edge-device exploitation tradecraft and the likely intrusion window (dwell time 5–14 days back-dates access to early/mid-September 2026):

Assessment (moderate confidence): The campaign's access pipeline likely combines CVE-2026-50751 or CVE-2026-20316 exploitation for perimeter entry, with CVE-2026-59310 as the detonation amplifier against virtualized infrastructure.

Detection Engineering

Sigma Rules

---
title: BRAINCIPHER - Volume Shadow Copy Deletion Pre-Encryption
id: 7f3a1b2e-bc01-4d5e-9f6a-braincipher001
status: experimental
description: Detects vssadmin/wmic/bcdedit shadow copy deletion and boot recovery tampering characteristic of LockBit-builder-derived ransomware (BRAINCIPHER) prior to encryption detonation.
author: Security Arsenal Threat Intel
references:
  - https://securityarsenal.com/darkside
date: 2026/09/18
tags:
  - attack.impact
  - attack.t1490
logsource:
  category: process_creation
  product: windows
  service: security
detection:
  selection_img:
    Image|endswith:
      - 'vssadmin.exe'
      - 'wmic.exe'
      - 'bcdedit.exe'
  selection_cmd:
    CommandLine|contains:
      - 'delete shadows'
      - 'shadowcopy delete'
      - 'recoveryenabled no'
      - 'bootstatuspolicy ignoreallfailures'
  condition: selection_img and selection_cmd
falsepositives:
  - Legitimate backup administration (rare on endpoints)
level: critical
---
title: BRAINCIPHER - Remote Service Creation for Lateral Movement via PsExec or Admin Share
id: 7f3a1b2e-bc02-4d5e-9f6a-braincipher002
status: experimental
description: Detects remote service installation (Event ID 7045) with suspicious binary paths in ADMIN$, Temp, or user profile directories, consistent with BRAINCIPHER/LockBit-lineage lateral movement using PsExec-style tooling.
author: Security Arsenal Threat Intel
references:
  - https://securityarsenal.com/darkside
date: 2026/09/18
tags:
  - attack.lateral-movement
  - attack.t1021.002
  - attack.t1569.002
logsource:
  product: windows
  service: system
detection:
  selection:
    EventID: 7045
  filter_paths:
    ServiceFileName|contains:
      - 'ADMIN$'
      - '\AppData\'
      - '\Temp\'
      - '\Users\Public\'
      - 'PSEXESVC'
  condition: selection and filter_paths
falsepositives:
  - Legitimate software deployment tools (SCCM, PDQ) - baseline known deployment service names
level: high
---
title: BRAINCIPHER - Data Staging with Archiving Utilities Prior to Exfiltration
id: 7f3a1b2e-bc03-4d5e-9f6a-braincipher003
status: experimental
description: Detects execution of compression/archiving utilities (7z, rar) with password or high-volume flags on servers, consistent with BRAINCIPHER double-extortion staging before exfiltration.
author: Security Arsenal Threat Intel
references:
  - https://securityarsenal.com/darkside
date: 2026/09/18
tags:
  - attack.collection
  - attack.t1560.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '7z.exe'
      - '7za.exe'
      - 'rar.exe'
      - 'winrar.exe'
  selection_cmd:
    CommandLine|contains:
      - ' a '
      - ' -p'
      - ' -hp'
  filter_legit:
    CommandLine|contains:
      - 'backup_agent'
      - 'veeam'
  condition: selection_img and selection_cmd and not filter_legit
falsepositives:
  - IT administrators archiving project deliverables - tune per host role
level: high

Microsoft Sentinel KQL — Pre-Ransomware Staging & Lateral Movement Hunt

// BRAINCIPHER pre-detonation hunt: correlate archiving, share enumeration, and new remote services within a 7-day window
let Window = 7d;
let ArchivingHosts =
    DeviceProcessEvents
    | where TimeGenerated > ago(Window)
    | where FileName in~ ('7z.exe','7za.exe','rar.exe','winrar.exe')
    | where ProcessCommandLine has_any (' -p', ' -hp', ' a ')
    | summarize FirstArchive=min(TimeGenerated) by DeviceName, InitiatingProcessAccountName;
let ShareEnum =
    DeviceProcessEvents
    | where TimeGenerated > ago(Window)
    | where FileName =~ 'net.exe' and ProcessCommandLine has_any ('view', 'share')
    | summarize ShareEnumCount=count() by DeviceName;
let NewRemoteServices =
    Event
    | where TimeGenerated > ago(Window)
    | where EventLog == 'System' and EventID == 7045
    | extend ServiceFile = tostring(parse_json(EventData).param1)
    | extend ServiceName = tostring(parse_json(EventData).ImagePath)
    | where ServiceName has_any ('ADMIN$', 'Temp', 'Public', 'PSEXESVC')
    | summarize NewServices=count() by Computer;
ArchivingHosts
| join kind=inner ShareEnum on DeviceName
| join kind=inner NewRemoteServices on $left.DeviceName == $right.Computer
| project DeviceName, InitiatingProcessAccountName, FirstArchive, ShareEnumCount, NewServices
| sort by FirstArchive asc;

PowerShell — Rapid Triage Script (Run on Suspected Hosts / Tier-0 Servers)

# BRAINCIPHER rapid-response triage: shadow copies, new scheduled tasks, new services, RDP exposure
Write-Host '=== [1] Volume Shadow Copies ===' -ForegroundColor Cyan
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
if ($null -eq $shadows) { Write-Host 'WARNING: No shadow copies found - possible T1490 tampering' -ForegroundColor Red } else { $shadows | Select-Object InstallDate, VolumeName | Format-Table }

Write-Host '=== [2] Scheduled Tasks Created in Last 7 Days ===' -ForegroundColor Cyan
Get-ScheduledTask | ForEach-Object {
    $info = Get-ScheduledTaskInfo $_
    $task = $_
    $xml = Export-ScheduledTask -TaskName $task.TaskName -TaskPath $task.TaskPath -ErrorAction SilentlyContinue
    if ($xml -match '<Date>([^<]+)</Date>') {
        $created = [datetime]$Matches[1]
        if ($created -gt (Get-Date).AddDays(-7)) { [PSCustomObject]@{ Name=$task.TaskName; Path=$task.TaskPath; Created=$created } }
    }
} | Format-Table -AutoSize

Write-Host '=== [3] Services Installed in Last 7 Days ===' -ForegroundColor Cyan
Get-WinEvent -FilterHashtable @{LogName='System'; Id=7045; StartTime=(Get-Date).AddDays(-7)} -ErrorAction SilentlyContinue |
    Select-Object TimeCreated, @{N='Service';E={$_.Properties[0].Value}}, @{N='ImagePath';E={$_.Properties[1].Value}} | Format-List

Write-Host '=== [4] RDP Exposure Check ===' -ForegroundColor Cyan
$rdp = Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections -ErrorAction SilentlyContinue
Write-Host ('RDP Enabled (0=enabled): ' + $rdp.fDenyTSConnections)
Get-NetTCPConnection -LocalPort 3389 -State Listen -ErrorAction SilentlyContinue | Select-Object LocalAddress, LocalPort, OwningProcess

Write-Host '=== [5] Recent Failed Logons (Brute Force Indicator) ===' -ForegroundColor Cyan
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=(Get-Date).AddDays(-1)} -MaxEvents 50 -ErrorAction SilentlyContinue |
    Group-Object @{E={$_.Properties[5].Value}} | Sort-Object Count -Descending | Select-Object Count, Name | Format-Table

Incident Response Priorities — BRAINCIPHER Playbook

T-Minus Detection Checklist (Pre-Encryption Window)

1. vssadmin / bcdedit execution on servers — this group's LockBit-lineage payloads tamper with recovery within minutes of detonation. Any such execution outside a change window is a page-the-oncall event.
2. New 7045 services on multiple hosts from a single source account — precursor to mass PsExec-style payload push or GPO-based distribution.
3. Bulk archiving on file servers — 7z/rar with password flags against shares containing project data = exfiltration staging. Double extortion means encryption may not fire for days after theft is complete.
4. vCenter/ESXi anomalies — new vCenter sessions from non-admin subnets, datastore browsing, or unexpected VM power-offs. Given CVE-2026-59310's KEV status, treat any vCenter compromise as a ransomware pre-positioning event.
5. Outbound volume spikes to uncommon destinations — mega.io, anonfile-style hosts, or raw IP transfers from server VLANs.

Assets This Gang Prioritizes for Exfiltration

• Client deliverables and project files (CAD/GIS/design documents — high leverage against engineering firms' clients)
• Contracts, bid/pricing data, and financial records
• HR/PII stores for regulatory-pressure amplification
• Email archives of executive leadership (negotiation leverage)

Containment — Ordered by Urgency

1. Isolate the hypervisor management plane (vCenter, iDRAC/iLO, storage controllers) — sever from general user VLANs immediately. Hypervisor encryption is the worst-case outcome.
2. Disable/rotate the suspected compromised accounts, especially any account observed in 7045 events across multiple hosts; force krbtgt double-reset if lateral movement reached Tier-0.
3. Block egress to file-sharing and bulletproof hosting ASNs at the perimeter; preserve netflow before rule changes.
4. Snapshot/backup verification — confirm offline/immutable backups are intact and not mounted to production; BRAINCIPHER-lineage payloads hunt reachable backup repositories.
5. Edge device forensics — image VPN gateway / firewall management interfaces (CVE-2026-50751 / CVE-2026-20316 surfaces) before patching destroys volatile evidence.
6. Assume data theft — engage legal/comms for disclosure obligations even if encryption is prevented; the leak site posting is the extortion lever, not the ransom note.

Hardening Recommendations

Immediate (24 Hours)

• Patch or mitigate the KEV perimeter stack: Check Point Security Gateway (CVE-2026-50751 — disable IKEv1 if unpatched), Cisco Secure FMC (CVE-2026-20316), VMware vCenter (CVE-2026-59310), ConnectWise ScreenConnect (CVE-2024-1708). These are CISA-confirmed ransomware vectors; treat as emergency change.
• Audit and restrict RDP: disable internet-facing 3389 entirely; require VPN + MFA for internal RDP; alert on >5 failed 4625s per account per hour.
• Block vssadmin/bcdedit/wmic shadow deletion via AppLocker/WDAC or EDR custom rules on all servers; alert-only on workstations.
• Verify immutable/offline backups and confirm backup infrastructure credentials are vaulted and separate from AD.
• Deploy the Sigma rules and KQL hunt above to your SIEM/EDR and run a retro-hunt over the last 14 days.

Short-Term (2 Weeks)

• Segment the virtualization management plane into a dedicated, jump-host-gated VLAN with its own credential tier.
• Implement egress filtering with destination categorization — deny unclassified file-sharing and newly-registered domains from server segments; exfiltration is the extortion payload.
• Deploy deception: honey-credentials and canary file shares in project-data directories; BRAINCIPHER operators enumerate shares during staging and will trip these.
• Enforce phishing-resistant MFA (FIDO2) on VPN, firewall management, and vCenter access; hard-coded credential CVEs make password-only paths fatal.
• Tabletop the double-extortion scenario — legal, comms, and IR must rehearse the 'data leaked, no encryption' outcome, since that is this gang's most damaging play against professional-services firms with client confidentiality obligations.

Security Arsenal continues to monitor BRAINCIPHER's leak site for additional postings. Organizations in engineering, consulting, or technology sectors in GB/US/CA that observe any indicator above should engage incident response immediately — dwell time estimates suggest intrusions matching this wave may still be in pre-detonation stages.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub