BRAVOX Ransomware Gang: 2 New Victims Posted — European Healthcare & Industrial Targeting Analysis with Detection Rules

Monitoring of the BRAVOX ransomware gang's dark web leak site on 2026-08-08 confirms 2 new victim postings in the last 100 entries, indicating a currently active but low-volume campaign concentrated in Europe:

While BRAVOX is not a high-volume RaaS operation, its victim selection pattern — a French healthcare provider followed by a Swiss mid-market firm within 48 hours — suggests a deliberate, hands-on-keyboard campaign against organizations with weak edge-device hygiene and limited detection maturity. Healthcare organizations in France and Switzerland, and any enterprise running Check Point, Cisco FMC, ConnectWise ScreenConnect, or Microsoft Exchange at the perimeter, should treat this briefing as an immediate action item.

1. Threat Actor Profile — BRAVOX

Aliases: No widely documented aliases; operates under a single brand on its dedicated leak site (DLS). Infrastructure is hosted on a Tor .onion service with mirrored victim announcements.

Operating model: BRAVOX exhibits characteristics of a closed/semi-closed ransomware group rather than an open RaaS marketplace. Low posting velocity (2 victims per 100-posting window) combined with consistent sector selection suggests a small core operator set handling intrusions directly, possibly with a limited number of trusted initial access brokers (IABs).

Ransom demands: Consistent with European mid-market targeting, demands are assessed to fall in the $250K–$2M USD range, scaled to victim revenue. Healthcare victims typically face higher-pressure negotiations due to patient-data sensitivity.

Initial access methods (assessed):

• Exploitation of edge/VPN infrastructure — strongly correlated with the actively exploited CVEs tracked alongside this campaign (see Section 2)
• Phishing with macro-enabled documents or malicious installer lures (the Nx Console supply-chain CVE is notable here for developer-heavy organizations)
• Exposed RDP brute forcing against SMBs without MFA

Extortion model: Classic double extortion — data is exfiltrated and staged on the leak site with countdown timers before or concurrent with encryption. Both recent victims appeared on the DLS, implying data theft claims even where encryption status is unconfirmed.

Dwell time: Groups of this profile typically operate with 5–14 days of dwell time between initial access and detonation/leak publication, with the majority of that window spent on reconnaissance, lateral movement, and data staging.

2. Current Campaign Analysis

Sector targeting: Healthcare (MEDICOS, FR) and a non-classified industrial/services firm (MITC AG, CH). Healthcare targeting is consistent with the broader 2026 trend of ransomware groups returning to European healthcare after regulatory pressure briefly suppressed it — patient records command high extortion leverage and French healthcare entities have historically under-invested in segmentation.

Geographic concentration: 100% European in this window (France, Switzerland). This suggests either regional operator preference, francophone social-engineering capability, or acquired access from IABs selling European VPN/domain credentials.

Victim profile: Both victims fit the mid-market profile — estimated revenue in the €10M–€150M range. These organizations typically have:

• Small or outsourced IT security teams
• Flat network architectures with limited segmentation
• Perimeter VPN/remote-access infrastructure with inconsistent patching cadence

Posting frequency / escalation: Two postings in consecutive days (08-06, 08-07) indicates the operators are in an active detonation/publication phase. Expect 1–2 additional European victims within the next 7–14 days if the campaign follows historical cadence.

CVE correlation — likely initial access vectors: The CISA KEV entries tracked in parallel with this activity paint a clear picture of the access stack BRAVOX-type operators favor:

• CVE-2026-50751 (Check Point Security Gateway, improper authentication in IKEv1) — the single most probable initial access vector for this campaign. VPN gateway compromise yields immediate internal network presence. Patch/mitigate immediately.
• CVE-2026-20131 (Cisco FMC / SCC Firewall Management, deserialization) — firewall management plane compromise enables both access and defensive blind spots (log suppression, rule manipulation).
• CVE-2024-1708 (ConnectWise ScreenConnect path traversal → RCE) — remote access tooling abuse; also commonly repurposed post-compromise as a persistence mechanism.
• CVE-2023-21529 (Microsoft Exchange deserialization) — authenticated RCE on on-prem Exchange, consistent with targeting mid-market European orgs still running hybrid Exchange.
• CVE-2026-48027 (Nx Console embedded malicious code) — supply-chain angle; relevant for organizations with development teams, enabling developer-workstation footholds.

Assessment: The presence of two edge/security-appliance CVEs (Check Point, Cisco FMC) at the top of the list strongly suggests perimeter appliance exploitation is the primary initial access vector for this campaign, with Exchange and remote-access tooling as secondary paths.

3. Detection Engineering

The following Sigma rules target the TTP chain assessed for this campaign: VPN/edge exploitation follow-on activity, lateral movement via PsExec/WMI, and pre-encryption staging (shadow copy deletion, mass file access).

---
title: Suspicious Child Process from VPN or Security Appliance Service
description: Detects command shells or scripting engines spawned by VPN gateway, firewall management, or remote access tool processes - consistent with post-exploitation of Check Point/Cisco FMC/ScreenConnect compromise as seen in BRAVOX-type campaigns
id: 8f3a1c2e-4b7d-4e9a-b1f5-3c6d8e2a7b91
status: experimental
author: Security Arsenal Threat Intelligence
date: 2026/08/08
logsource:
    category: process_creation
    product: windows
    service: null
detection:
    selection_parent:
        ParentImage|endswith:
            - '\vpnd.exe'
            - '\cpd.exe'
            - '\fw1.exe'
            - '\ScreenConnect.Service.exe'
            - '\ScreenConnect.ClientService.exe'
            - '\tomcat.exe'
            - '\java.exe'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\wscript.exe'
            - '\cscript.exe'
            - '\rundll32.exe'
            - '\wmic.exe'
    condition: selection_parent and selection_child
falsepositives:
    - Legitimate firewall management scripts and ScreenConnect administrative sessions
level: high
tags:
    - attack.initial_access
    - attack.t1190
    - attack.execution
    - attack.t1059
---
title: Lateral Movement via PsExec Service Install or WMI Process Creation
description: Detects PsExec-style service installation (PSEXESVC) and WMI remote process creation - core lateral movement tradecraft used pre-detonation by hands-on-keyboard ransomware operators
id: 2e7b9d4f-6a3c-4f8b-a2d1-9e5c7b3f6a84
status: experimental
author: Security Arsenal Threat Intelligence
date: 2026/08/08
logsource:
    category: process_creation
    product: windows
detection:
    selection_psexec:
        Image|endswith:
            - '\PSEXESVC.exe'
            - '\PsExec.exe'
            - '\PsExec64.exe'
    selection_wmi:
        ParentImage|endswith: '\WmiPrvSE.exe'
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
    selection_admin_share:
        CommandLine|contains:
            - '\\ADMIN$\'
            - '\\C$\'
            - '\\IPC$\'
    condition: selection_psexec or selection_wmi or selection_admin_share
falsepositives:
    - Legitimate administrative tooling (SCCM, PDQ Deploy) - baseline and allowlist known admin hosts
level: high
tags:
    - attack.lateral_movement
    - attack.t1021.002
    - attack.t1047
    - attack.t1569.002
---
title: Pre-Ransomware Staging - Shadow Copy Deletion and Mass File Rename
description: Detects Volume Shadow Copy deletion via vssadmin/wmic/bcdedit and boot status tampering - near-universal T-minus indicator immediately preceding ransomware detonation
id: 5c1d8a3b-9f2e-4a7c-b6d4-8e3a1f5c2d97
status: experimental
author: Security Arsenal Threat Intelligence
date: 2026/08/08
logsource:
    category: process_creation
    product: windows
detection:
    selection_vssadmin:
        Image|endswith: '\vssadmin.exe'
        CommandLine|contains:
            - 'delete shadows'
            - 'resize shadowstorage'
    selection_wmic_shadow:
        Image|endswith: '\wmic.exe'
        CommandLine|contains: 'shadowcopy'
    selection_bcdedit:
        Image|endswith: '\bcdedit.exe'
        CommandLine|contains:
            - 'recoveryenabled'
            - 'bootstatuspolicy'
    selection_powershell_vss:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
        CommandLine|contains:
            - 'Get-WmiObject Win32_Shadowcopy'
            - 'Get-CimInstance Win32_ShadowCopy'
            - 'DeleteObject'
            - 'Remove-CimInstance'
    condition: 1 of selection_*
falsepositives:
    - Backup software maintenance windows and legitimate storage administration
level: critical
tags:
    - attack.impact
    - attack.t1490
    - attack.defense_evasion

KQL hunt query for Microsoft Sentinel targeting pre-ransomware staging and lateral movement patterns associated with this threat profile — run over a 7-day lookback across all Windows endpoints and servers:

// BRAVOX-profile hunt: pre-ransomware staging + lateral movement chain
// Lookback: 7 days. Correlate shadow copy tampering with suspicious remote execution.
let lookback = 7d;
let suspiciousStaging =
    DeviceProcessEvents
    | where TimeGenerated >= ago(lookback)
    | where FileName in~ ("vssadmin.exe", "wmic.exe", "bcdedit.exe", "wbadmin.exe")
       or (FileName in~ ("powershell.exe", "pwsh.exe")
           and ProcessCommandLine has_any ("Win32_ShadowCopy", "DeleteObject", "shadowcopy"))
    | project StagingTime=TimeGenerated, DeviceName, AccountName, StagingCmd=ProcessCommandLine, InitiatingProcessFileName;
let lateralMovement =
    DeviceProcessEvents
    | where TimeGenerated >= ago(lookback)
    | where FileName has_any ("psexec", "psexesvc")
       or (InitiatingProcessFileName =~ "WmiPrvSE.exe"
           and FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe"))
    | project LateralTime=TimeGenerated, DeviceName, AccountName, LateralCmd=ProcessCommandLine;
lateralMovement
| join kind=inner suspiciousStaging on DeviceName, AccountName
| extend HoursBetween = datetime_diff('hour', StagingTime, LateralTime)
| project DeviceName, AccountName, LateralTime, LateralCmd, StagingTime, StagingCmd, HoursBetween
| sort by StagingTime desc
;
// Secondary pivot: authentication anomalies from VPN-adjacent hosts
SigninLogs
| where TimeGenerated >= ago(lookback)
| where ResultType != 0
| summarize FailedAttempts=count(), DistinctIPs=dcount(IPAddress), IPs=make_set(IPAddress)
    by UserPrincipalName, bin(TimeGenerated, 1h)
| where FailedAttempts > 15 or DistinctIPs > 3
| sort by FailedAttempts desc

Rapid-response PowerShell script — enumerates the highest-priority T-minus indicators on a suspect host: recent scheduled tasks, shadow copy state, suspicious new local admins, and listening RDP exposure:

# BRAVOX Rapid Triage - run elevated on suspect hosts
# Checks: scheduled tasks (7d), VSS state, new local admins, RDP exposure
$cutoff = (Get-Date).AddDays(-7)
Write-Host "=== [1] Scheduled Tasks created in last 7 days ===" -ForegroundColor Cyan
Get-ScheduledTask | Where-Object {$_.Date -gt $cutoff} |
    Select-Object TaskName, TaskPath, Date, @{N='Action';E={$_.Actions.Execute}} |
    Format-Table -AutoSize

Write-Host "=== [2] Volume Shadow Copies (should NOT be empty on servers) ===" -ForegroundColor Cyan
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
if (-not $shadows) { Write-Host "WARNING: No shadow copies present - possible anti-forensics/T1490" -ForegroundColor Red }
else { $shadows | Select-Object DeviceObject, InstallDate | Format-Table -AutoSize }

Write-Host "=== [3] Local Administrators modified in last 7 days ===" -ForegroundColor Cyan
Get-LocalGroupMember -Group "Administrators" -ErrorAction SilentlyContinue |
    ForEach-Object {
        $u = Get-LocalUser -Name $_.Name.Split('\')[-1] -ErrorAction SilentlyContinue
        if ($u -and $u.PasswordLastSet -gt $cutoff) {
            Write-Host "RECENT CHANGE: $($_.Name) - PasswordLastSet $($u.PasswordLastSet)" -ForegroundColor Yellow
        } else { $_.Name }
    }

Write-Host "=== [4] RDP Exposure Check ===" -ForegroundColor Cyan
$rdp = Get-NetTCPConnection -LocalPort 3389 -State Listen -ErrorAction SilentlyContinue
if ($rdp) {
    $nla = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication -ErrorAction SilentlyContinue).UserAuthentication
    Write-Host "RDP LISTENING. NLA Enabled: $nla (0 = WEAK, enforce NLA+MFA)" -ForegroundColor $(if($nla -eq 1){'Green'}else{'Red'})
    Get-NetTCPConnection -RemotePort 3389 -State Established -ErrorAction SilentlyContinue |
        Select-Object RemoteAddress, OwningProcess | Format-Table -AutoSize
} else { Write-Host "RDP not listening on 3389" }

Write-Host "=== [5] Suspicious processes spawned by VPN/remote-access services ===" -ForegroundColor Cyan
Get-CimInstance Win32_Process | Where-Object {
    $_.Name -match 'cmd|powershell|wscript|cscript' -and
    (Get-CimInstance Win32_Process -Filter "ProcessId=$($_.ParentProcessId)" -ErrorAction SilentlyContinue).Name -match 'vpn|screenconnect|tomcat|java'
} | Select-Object ProcessId, Name, CommandLine | Format-List
Write-Host "=== Triage complete ===" -ForegroundColor Cyan

4. Incident Response Priorities

T-minus detection checklist (pre-encryption indicators), in order of signal value:

1. vssadmin delete shadows / bcdedit recoveryenabled no execution anywhere in the fleet — treat as imminent detonation, isolate host immediately
2. PsExec service installs or WmiPrvSE.exe spawning shells across multiple hosts within a short window — active lateral movement
3. New scheduled tasks or services created outside change windows, especially on domain controllers and file servers
4. Large outbound transfers (multi-GB) to unfamiliar cloud storage, VPS endpoints, or Tor-exit-adjacent infrastructure — data staging for double extortion
5. Anomalous VPN appliance authentication: IKEv1 negotiation anomalies on Check Point gateways, logins from unusual geographies, or session establishment outside business hours
6. Mass file access/rename bursts on file servers from a single account

Assets this threat profile historically prioritizes for exfiltration:

• Patient records and clinical databases (healthcare victims — highest extortion leverage)
• Finance/HR shares: payroll, contracts, banking details
• Legal and M&A document repositories
• Backup catalogues and credentials (to maximize encryption impact)
• Domain controller ntds.dit and credential stores

Containment actions, ordered by urgency:

1. Isolate affected hosts/segments at the switch/EDR level — do not power off (preserve memory)
2. Disable the compromised identity set; force enterprise-wide credential reset for tier-0/tier-1 accounts
3. Block egress to identified exfil destinations at the proxy/firewall; enable TLS inspection logging
4. Snapshot running VMs and capture memory on the suspected patient-zero host
5. Verify backup integrity and offline/immutable copy availability before any recovery actions
6. Revoke active VPN sessions and rotate gateway certificates if Check Point/Cisco edge devices are in scope
7. Engage IR retainer and legal counsel before any contact with the operators; monitor the BRAVOX DLS for victim posting

5. Hardening Recommendations

Immediate (24 hours):

• Patch or mitigate CVE-2026-50751 (Check Point IKEv1 improper authentication) — apply vendor hotfix; if patching is delayed, disable IKEv1 where feasible and restrict gateway management interfaces to allowlisted admin hosts
• Patch CVE-2026-20131 (Cisco FMC/SCC) and audit FMC admin accounts for unauthorized additions
• Patch or isolate ConnectWise ScreenConnect (CVE-2024-1708) instances; inventory all remote-access tooling and remove unauthorized instances
• Verify Exchange servers are patched against CVE-2023-21529; restrict EWS/remote PowerShell to required accounts
• Enforce MFA on all remote access (VPN, RDP gateways, ScreenConnect); block direct internet-exposed RDP entirely
• Deploy the Sigma rules and KQL queries above; alert on any shadow-copy deletion as critical
• Confirm offline/immutable backups and test one restore

Short-term (2 weeks):

• Segment clinical/OT and file-server VLANs from general user networks; deny workstation-to-workstation SMB/RDP by default
• Deploy EDR with tamper protection fleet-wide, prioritizing servers and VPN-adjacent jump hosts; enable credential theft detection on DCs
• Implement egress filtering and DLP alerting on bulk outbound transfers (>1 GB to unsanctioned destinations)
• Roll out LAPS and remove standing local admin rights; tier administrative model to protect tier-0 assets
• Establish dark web leak-site monitoring for your organization name and domains to cut leak-publication discovery time from days to minutes
• For developer-heavy organizations: audit build tooling against the Nx Console supply-chain incident (CVE-2026-48027), pin dependencies, and rotate any credentials present on developer workstations that ran the malicious version

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub