Ransomware: BrainCipher named maxwell-group.com (GB)

1. Executive summary

On 2026-09-29 the BrainCipher ransomware operation listed maxwell-group.com, a UK-registered domain, on its public leak site. The listing is a claim of compromise, not evidence of it: no victim statement, no sample, no initial-access vector and no data sample have been published, and the only content on the leak page is the domain, the country code GB and a placeholder. BrainCipher has no MITRE ATT&CK profile in our reference data, so the attribution to that operation rests on the leak-site listing alone and is unconfirmed. For EMEA financial services clients the immediate exposure is third-party and supply-chain, not direct: any institution with a live commercial or ICT dependency on a Maxwell Group entity should treat that dependency as potentially disrupted until the victim confirms or denies. There is no CVE, no CVSS score and no CISA KEV entry attached to this item, so it does not carry a patchable technical exposure.

2. Regulatory framing

No DORA incident-reporting article is engaged on the facts available. Art. 17, Art. 18 and Art. 19 attach to an incident affecting the institution's own ICT systems or a provider's service to it; a leak-site listing with no confirmed impact on service delivery does not by itself meet that threshold. If a client confirms operational impact through a Maxwell Group dependency, Art. 17 through Art. 19 become live and the classification and reporting clocks start from that confirmation, not from this listing.

3. Technical analysis & attack chain

There is no attack chain to reconstruct. The source material contains no initial-access vector, no exploited component, no CVE, no malware sample, no command-and-control detail and no exfiltration evidence. What follows is the full extent of what is confirmed.

1. On 2026-09-29T15:20:48 UTC, the ransomware.live index recorded a new victim entry under the group name BrainCipher.
2. The entry names the victim as maxwell-group.com, country GB, website maxwell-group.com.
3. The leak page carries a DNS records section and a leak screenshot placeholder. No DNS values, no screenshot content and no data sample are present in the material supplied to us.
4. No ransom demand, deadline, negotiation status or data-volume claim is published on the page.

The victim identification is unresolved. The page itself carries an AI-generated note stating that the author could not verify a specific company at maxwell-group.com and that multiple unrelated businesses use variations of the Maxwell Group name across different industries and countries. That note is part of the leak-site content, not an independent finding, but it matches our own position: we cannot confirm which legal entity, in which sector, at which address, is the intended victim. Any client matching on the name alone risks acting on the wrong organisation.

BrainCipher is a ransomware brand that has operated a leak site and has been associated in public reporting with attacks on public-sector and enterprise targets. Our verified reference data holds no MITRE ATT&CK profile for the group, no tooling list, no infrastructure and no confirmed victim set. Treat the group attribution as unconfirmed and treat any capability description of BrainCipher that you have seen elsewhere as outside the evidence base of this advisory.

Confidence caveat: every fact above is single-sourced to the ransomware.live index entry and its associated page. There is no second source, no victim confirmation and no technical artefact. Do not treat this listing as confirmation of a breach, and do not treat the absence of a sample as evidence that no breach occurred.

4. Mitigation & containment

The correct response to an unverified leak-site listing is verification first, containment second. Do not isolate systems on the strength of a leak-site page.

P1, within 24 hours

• Determine whether your institution holds any live contract, data-processing relationship or ICT service dependency with an entity trading as Maxwell Group at maxwell-group.com or a related domain. Check the vendor register, the accounts-payable supplier list and the third-party risk inventory. If nothing matches, close the item and record the negative result.
• If a relationship exists, contact the counterparty through a channel you already trust, not through contact details on any leak page, and ask directly whether they have an incident. Record the answer and the time.
• Do not visit the leak site from corporate infrastructure. The ransomware.live index page is a public index and is safe to read; the operator's own leak page is not, and it is a common delivery path for secondary extortion and for tracking who is looking.
• If the counterparty confirms an incident that touches your data or your service, start your DORA Art. 17 incident process and begin the Art. 18 classification assessment immediately.

P2, within 72 hours

• For any confirmed in-scope provider, request their incident timeline, the data categories affected, and whether your data was in scope. Ask for it in writing.
• Review what access your institution grants that provider: VPN accounts, API keys, service accounts, SSO trust, shared file paths. Suspend or rotate anything not currently needed. This is the containment step that matters, because a compromised provider with standing access to your environment is the actual risk, not the listing.
• Check your own telemetry for authentication from the provider's known source addresses over the preceding 30 days, and for any new or unusual service-account use.

P3, within 7 days

• If the provider is critical, run the DORA Art. 29 concentration assessment and confirm the Art. 30 contractual provisions cover incident notification, cooperation and audit.
• Where the relationship is material and the provider cannot evidence controls, begin identifying an alternative supplier. Do not wait for confirmation of this specific incident to start that work if the dependency is already a concentration risk.

There is no patch, no version pin and no vendor fix for this item. No CVE is associated with it.

5. Indicators of compromise

No indicators of compromise available in the source material. The leak page contains no hashes, no domains beyond the victim's own, no IP addresses, no file paths, no registry keys and no ransom-note text. The DNS records section on the page is empty in the material supplied.

Behavioural indicators

6. Detection

Insufficient indicators to author detection rules. The source material contains no distinctive strings, command-line flags, mutex names, scheduled-task or service names, file names, registry keys, ransom-note text or hard-coded values. The only strings present are the victim domain and the group name, which are not artefacts of the threat and would produce rules that match reporting about the incident rather than the incident itself.

7. Sources

• ransomware.live, "Victim: maxwell-group.com – BrainCipher", https://www.ransomware.live/id/bWF4d2VsbC1ncm91cC5jb21AQnJhaW5DaXBoZXI=, published 2026-09-29. Single source for all facts in this advisory.

8. Adverse Trace position

We assess this as a low-confidence, unverified extortion listing with no technical corroboration, and we are not raising it above that on the evidence available. The severity of the underlying event, if there is one, is unknown: no CVE, no CVSS score and no CISA KEV entry apply, and no data volume, deadline or sample has been published. Client impact is limited to those with a genuine dependency on a Maxwell Group entity, and for those clients the risk is provider access into their own environment, not the listing itself. We will monitor the leak site for a data sample, a deadline or a victim statement, and we will reissue if any of those appear or if a second source corroborates the compromise. We will not name a specific Maxwell Group legal entity until one is confirmed, and we recommend clients take the same position in their own records.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.