Brotherhood is a financially motivated ransomware group that emerged in October 2025, operating a Tor-based double-extortion leak site to pressure victims into paying ransoms. The group is characterized as a relatively small entity within the broader ransomware ecosystem, exhibiting operational patterns more akin to smaller ransomware gangs rather than expansive, affiliate-based Ransomware-as-a-Service (RaaS) operations. Brotherhood prioritizes rapid deployment of ransomware and relies on common ransomware frameworks and established extortion tactics, rather than developing bespoke malware, often providing minimal information about itself on its dark web sites.
RansomLook pivots
Data, inteligencia y referencias externas para contrastar actividad ransomware del actor.
United Arab EmiratesAustraliaCanadaSwitzerlandGermanyUnited KingdomIndiaItalyJamaicaNepal
Sectores atacados
Manufacturing (2)
Sectores objetivo (SOCRadar)
Construction of BuildingsOther Information ServicesSoftware PublishersReal EstateEnterprises & HoldingManufacturingConstructionPublic AdministrationAdministrative &Waste Management Oil & Gas