Skip to main content
Darkfield

Operator dossier

brotherhood is a ransomware operator currently active on public leak sites. Darkfield has indexed 18 public victims claimed by this operator between October 10, 2025 and January 6, 2026. The Brotherhood ransomware group is a recently emerged financially-motivated cybercriminal organization first observed in October 2025, representing one of the newer entrants in the ransomware landscape. Given the group's recent emergence and limited public documentation from major security firms and law enforcement agencies, detailed information about their origin, country of operation, and specific affiliations remains largely unknown to open-source intelligence. Based on observed targeting patterns, the group appears to employ opportunistic attack methodologies, focusing primarily on English-speaking markets including the United States, Australia, and Canada, while also targeting victims in Germany and Switzerland, suggesting either broad-spectrum initial access capabilities or acquisition of access through underground markets. Their victim selection spans multiple sectors including business services, construction, transportation and logistics, and technology companies, indicating a non-discriminatory approach typical of many financially-motivated ransomware operations rather than targeted campaigns against specific industries. With only 18 documented victims since their October 2025 emergence, Brotherhood represents a relatively small-scale operation compared to established ransomware groups, and specific details regarding their encryption methods, data exfiltration practices, or extortion tactics have not been publicly documented by major threat intelligence providers. The group remains active as of the latest available intelligence, though their limited operational footprint and recent emergence means comprehensive analysis of their tactics, techniques, and procedures awaits further documentation by security researchers and law enforcement agencies.

Most-targeted sectors

Most-affected countries

Recent disclosures by brotherhood

All 18 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for brotherhood →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Active ransomware operator

← All groups

brotherhood

18 victims indexed · first seen 9 months ago · last activity 6 months ago

18
Victims indexed
#166 of 364 tracked operators
3m
Active period
Oct 2025 → Jan 2026
8
Countries hit
top US · 6

At a glance

Status
active
First seen
9 months ago
Last activity
6 months ago
Onion sites
1 known endpoint
Primary sector
Not Found · 9 hits

About

The Brotherhood ransomware group is a recently emerged financially-motivated cybercriminal organization first observed in October 2025, representing one of the newer entrants in the ransomware landscape. Given the group's recent emergence and limited public documentation from major security firms and law enforcement agencies, detailed information about their origin, country of operation, and specific affiliations remains largely unknown to open-source intelligence. Based on observed targeting patterns, the group appears to employ opportunistic attack methodologies, focusing primarily on English-speaking markets including the United States, Australia, and Canada, while also targeting victims in Germany and Switzerland, suggesting either broad-spectrum initial access capabilities or acquisition of access through underground markets. Their victim selection spans multiple sectors including business services, construction, transportation and logistics, and technology companies, indicating a non-discriminatory approach typical of many financially-motivated ransomware operations rather than targeted campaigns against specific industries. With only 18 documented victims since their October 2025 emergence, Brotherhood represents a relatively small-scale operation compared to established ransomware groups, and specific details regarding their encryption methods, data exfiltration practices, or extortion tactics have not been publicly documented by major threat intelligence providers. The group remains active as of the latest available intelligence, though their limited operational footprint and recent emergence means comprehensive analysis of their tactics, techniques, and procedures awaits further documentation by security researchers and law enforcement agencies.

References

1 link

External sources curated by the MISP threat-intel community.

Timeline

4 months
2025-10-01T00:00:00+00:00 · 102025-11-01T00:00:00+00:00 · 62025-12-01T00:00:00+00:00 · 12026-01-01T00:00:00+00:00 · 1
2025-10-01T00:00:00+00:002026-01-01T00:00:00+00:00

Top countries

🇺🇸 United States
6
🇦🇺 Australia
3
🇨🇦 Canada
2
🇩🇪 Germany
2
🇨🇭 Switzerland
1
🇿🇦 South Africa
1
🇮🇹 Italy
1
🇬🇧 United Kingdom
1
United States dossier →Australia dossier →Canada dossier →Germany dossier →

Top sectors

Business Services
2
Construction
1
Transportation/Logistics
1
Technology
1
Public Sector
1
Energy
1
Consumer Services
1
Manufacturing
1
Business Services dossier →Construction dossier →Transportation/Logistics dossier →Technology dossier →

MITRE ATT&CK

4 techniques · 3 tactics

Tactics

Initial AccessExecutionImpact

Techniques

  • T1566Phishing
  • T1190Exploit Public-Facing Application
  • T1059Command and Scripting Interpreter
  • T1486Data Encrypted for Impact

Recent victims

Loading…

Onion infrastructure

1 known
  • http://brohoodyaifh2ptccph5zfljyajjabwjjo4lg6gfp4xb6ynw5w7ml6id.onion

Source

Updated 6 months ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time brotherhood posts a victim.

Add brotherhood to your watchlist — Pro pings you within 5 minutes of any new brotherhood leak-site post, Telegram callout, or affiliate-rebrand inference.