// THREAT ACTOR

BROTHERHOOD_

Dormant

BROTHERHOOD is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem — file encryption combined with the threat of stolen-data publication on a public leak site — and continues to post fresh victim claims as part of an ongoing extortion campaign.

For Ransomnews editorial coverage of BROTHERHOOD — incident write-ups, attribution notes, and additional context — see the Threat Groups archive or run a site search.

25 Victims tracked

0 / 15 Active mirrors

2025-10-09 First listing

2026-01-06 Most recent

Victims by year

2026 1
2025 24

Leak site mirrors

15 mirrors tracked, 0 currently reachable. These are criminal-infrastructure URLs — links are deliberately not provided.

brohoodyaifh2ptccph5zfljyajjabwjjo4lg6gfp4xb6ynw5w7ml6id.onion BrotherHood snapshot · 2026-01-21 17:03
fotxzhnoxtkpa6cwkimysoiy6o3ostmekoa3k6sy6ka5a7nuwddjciqd.onion snapshot · 2025-10-09 17:21
a5wdkdd7unaacdlzcjm5javijatjwkkp726diotek3dvvaibqt7s4yqd.onion snapshot · 2025-10-09 17:23
xwhzg446dgqx4ofxtidnjihugtii2ydebe6e33m7njzcql5qvkgpv3qd.onion snapshot · 2025-10-09 17:24
azgepwfm4g4btbnf2qmc7qtniuqw3wqtpahqmzisnkcvfwdbl6izwsad.onion snapshot · 2025-10-09 17:25
x2z7lngyalgei4zeerq5h3esvtnzisxdljjocqa6555qpivi3cmlrgyd.onion snapshot · 2025-10-09 17:27
uwwia3msl6b7ykekgbr7xxnxmpkq7wpgqze5vu7phzkm5eaeueoxtcad.onion snapshot · 2025-10-09 17:29
sj2wws6vnambuzjbvaqy5tyg6hp4mm2nwyc4wne356exwzgq6ayrjhqd.onion Index of / snapshot · 2026-03-13 02:12
2lb5n6bqncc4lu4grm46cpoqrq3yyuriyfzdwlemuajj6x6jbbsgrbqd.onion Index of / snapshot · 2026-03-13 03:02
lashkbx7rkjrvrhkch3oit37tg5dlzjx5eyo3scnmox7sg2v4nmldaad.onion Index of / snapshot · 2026-03-13 02:27
4n6h3qqewk6dlqribjmw64al5szeuyhcbbfoar37p3yr43hz365nwnyd.onion Index of / snapshot · 2026-03-13 02:27
cxhu5iruoa3vkmn4blslh4qzabs6jzk26esxnngzjdlquo2beu2nrhyd.onion Index of / snapshot · 2026-03-13 02:12
eyh7wketm3dwqadwfv5dti3yewbr7smrepmavshjfohhc6qwub44knqd.onion Index of / snapshot · 2026-03-13 03:07
tb2utalqu7qwyk33o7hccjoszprt6fsrpggrbwwzi72bu6f5wocqqhyd.onion Index of / snapshot · 2026-03-13 03:01
n5yiabvtytglkrpvxgultoekllhpivoshu5glizwxvtvk4fkymdr6uqd.onion Index of / snapshot · 2026-03-13 03:08

Recent victims

The 50 most recent victims claimed by BROTHERHOOD. Total in the index: 25.

Date listed	Victim	Description
2026-01-06	Italgrafica Sistemi	Printing and Packaging
2025-12-11	Häussermann stauden gehölze gmbh	Agricultural Sector
2025-12-10	häussermann stauden gehölze gmbh	Agricultural Sector
2025-11-28	Ingenieurbüro Laudi	Electricity, Oil & Gas
2025-11-17	Announcement till 20/11	Engineering Office
2025-11-15	Ninas Jewellery	Jewelry & Watch Retail
2025-11-14	Kaener Personal	Membership Organizations
2025-11-13	Cera Stribley	Architecture and interior design practice based
2025-11-13	Announcement till 14/11	Membership Organizations
2025-11-13	Announcement till 15/11	Jewelry & Watch Retail
2025-11-10	Spoleta Construction	Commercial & Residential Construction
2025-11-06	Horst Realty	Real Estate
2025-10-29	Announcement until 31.10	Membership Organizations
2025-10-11	Integlia	Tax & Bookkeeping Solution
2025-10-11	Citizens' Committee for Children of New York	Organizations
2025-10-09	Announcement	Organizations USA Contains: Files
2025-10-09	Announcement	Tax & Bookkeeping Solution Canada Contains: Files
2025-10-09	Coal Industry Social Welfare Organisation	https://www.ciswo.org.uk/ Non-Profit & Charitable Organizations UK …
2025-10-09	Orion Communications and Public Relations	https://www.orioncommunications-pr.com/ Advertising & Marketing USA …
2025-10-09	Motility Software	https://www.motilitysoftware.com/ Software USA Contains: 3.3 Gb com…
2025-10-09	UVJ Technologies	https://www.uvjtech.com/ Business Services USA Contains: NO DATA
2025-10-09	Woodmen Valley Chapel	https://woodmenvalley.org/ Religion USA Contains: 274 Gb compressed…
2025-10-09	Kevmor	https://www.kevmor.com.au/ Manufacturing Australia Contains: 45 Gb …
2025-10-09	Sternthal Montigny Greenberg St-Germain
2025-10-09	Momentum Logistics

← Back to Ransomtracker

Statistics on this page are computed by Ransomnews from a live leak-site monitoring feed. Numbers update every ten minutes. Operator-written victim descriptions are truncated and shown in snippet form only. Source data: RansomLook (CC BY 4.0), aggregated and adapted by Ransomnews.