THREAT ACTOR
BROTHERHOOD_
DormantBROTHERHOOD is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem: file encryption combined with the threat of stolen-data publication on a public leak site. It continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of BROTHERHOOD, including incident write-ups, attribution notes and additional context, see the Threat Groups archive or run a site search.
Victims by year
- 2026 1
- 2025 24
Leak site mirrors
15 mirrors tracked, 0 currently reachable. These are criminal-infrastructure URLs; links are deliberately not provided.
-
brohoodyaifh2ptccph5zfljyajjabwjjo4lg6gfp4xb6ynw5w7ml6id.onionBrotherHood snapshot · 2026-01-21 17:03 -
fotxzhnoxtkpa6cwkimysoiy6o3ostmekoa3k6sy6ka5a7nuwddjciqd.onionsnapshot · 2025-10-09 17:21 -
a5wdkdd7unaacdlzcjm5javijatjwkkp726diotek3dvvaibqt7s4yqd.onionsnapshot · 2025-10-09 17:23 -
xwhzg446dgqx4ofxtidnjihugtii2ydebe6e33m7njzcql5qvkgpv3qd.onionsnapshot · 2025-10-09 17:24 -
azgepwfm4g4btbnf2qmc7qtniuqw3wqtpahqmzisnkcvfwdbl6izwsad.onionsnapshot · 2025-10-09 17:25 -
x2z7lngyalgei4zeerq5h3esvtnzisxdljjocqa6555qpivi3cmlrgyd.onionsnapshot · 2025-10-09 17:27 -
uwwia3msl6b7ykekgbr7xxnxmpkq7wpgqze5vu7phzkm5eaeueoxtcad.onionsnapshot · 2025-10-09 17:29 -
sj2wws6vnambuzjbvaqy5tyg6hp4mm2nwyc4wne356exwzgq6ayrjhqd.onionIndex of / snapshot · 2026-03-13 02:12 -
2lb5n6bqncc4lu4grm46cpoqrq3yyuriyfzdwlemuajj6x6jbbsgrbqd.onionIndex of / snapshot · 2026-03-13 03:02 -
lashkbx7rkjrvrhkch3oit37tg5dlzjx5eyo3scnmox7sg2v4nmldaad.onionIndex of / snapshot · 2026-03-13 02:27 -
4n6h3qqewk6dlqribjmw64al5szeuyhcbbfoar37p3yr43hz365nwnyd.onionIndex of / snapshot · 2026-03-13 02:27 -
cxhu5iruoa3vkmn4blslh4qzabs6jzk26esxnngzjdlquo2beu2nrhyd.onionIndex of / snapshot · 2026-03-13 02:12 -
eyh7wketm3dwqadwfv5dti3yewbr7smrepmavshjfohhc6qwub44knqd.onionIndex of / snapshot · 2026-03-13 03:07 -
tb2utalqu7qwyk33o7hccjoszprt6fsrpggrbwwzi72bu6f5wocqqhyd.onionIndex of / snapshot · 2026-03-13 03:01 -
n5yiabvtytglkrpvxgultoekllhpivoshu5glizwxvtvk4fkymdr6uqd.onionIndex of / snapshot · 2026-03-13 03:08
Recent victims
The 50 most recent victims claimed by BROTHERHOOD. Total in the index: 25.
| Date listed | Victim | Description |
|---|---|---|
| 2026-01-06 | Italgrafica Sistemi | Printing and Packaging |
| 2025-12-11 | Häussermann stauden gehölze gmbh | Agricultural Sector |
| 2025-12-10 | häussermann stauden gehölze gmbh | Agricultural Sector |
| 2025-11-28 | Ingenieurbüro Laudi | Electricity, Oil & Gas |
| 2025-11-17 | Announcement till 20/11 | Engineering Office |
| 2025-11-15 | Ninas Jewellery | Jewelry & Watch Retail |
| 2025-11-14 | Kaener Personal | Membership Organizations |
| 2025-11-13 | Cera Stribley | Architecture and interior design practice based |
| 2025-11-13 | Announcement till 14/11 | Membership Organizations |
| 2025-11-13 | Announcement till 15/11 | Jewelry & Watch Retail |
| 2025-11-10 | Spoleta Construction | Commercial & Residential Construction |
| 2025-11-06 | Horst Realty | Real Estate |
| 2025-10-29 | Announcement until 31.10 | Membership Organizations |
| 2025-10-11 | Integlia | Tax & Bookkeeping Solution |
| 2025-10-11 | Citizens' Committee for Children of New York | Organizations |
| 2025-10-09 | Announcement | Organizations USA Contains: Files |
| 2025-10-09 | Announcement | Tax & Bookkeeping Solution Canada Contains: Files |
| 2025-10-09 | Coal Industry Social Welfare Organisation | https://www.ciswo.org.uk/ Non-Profit & Charitable Organizations UK … |
| 2025-10-09 | Orion Communications and Public Relations | https://www.orioncommunications-pr.com/ Advertising & Marketing USA … |
| 2025-10-09 | Motility Software | https://www.motilitysoftware.com/ Software USA Contains: 3.3 Gb com… |
| 2025-10-09 | UVJ Technologies | https://www.uvjtech.com/ Business Services USA Contains: NO DATA |
| 2025-10-09 | Woodmen Valley Chapel | https://woodmenvalley.org/ Religion USA Contains: 274 Gb compressed… |
| 2025-10-09 | Kevmor | https://www.kevmor.com.au/ Manufacturing Australia Contains: 45 Gb … |
| 2025-10-09 | Sternthal Montigny Greenberg St-Germain | |
| 2025-10-09 | Momentum Logistics |
CONFIRMED ATTACKS
Brotherhood confirmed attacks: 1 verified incident
Ransomnews has verified 1 Brotherhood incident against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. All of them fall in November 2025. Switzerland accounts for 1 of them (100%). The most affected sector is service, at 1 confirmed victim.
Confirmed victims by year
Most affected sectors
Most affected countries
Verified Brotherhood incidents
| Date | Organisation | Sector | Location | Records | Ransom paid | Source |
|---|---|---|---|---|---|---|
| November 2025 | Käner Personal AG | Service | Baar, Switzerland | — | Unknown | Source |
Claimed vs confirmed. The figures above the fold on this page come from Brotherhood's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design: most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.