Skip to content
Cyber Threat
CTI Academy Sponsor CTI Academy
Ransomware group

Brotherhood ransomware

18 victims listed on the Brotherhood leak site across 8 countries. Most recent disclosure .

Victims
18
0.1% of all tracked
Countries
8
Most: United States
Sectors
9
Most: Business Services
First seen
Oct 2025
In this database

ThreatAI analysis

Compiled from the ransomware.live profile for Brotherhood and from this database. Figures and technique mappings are quoted from the source data, not inferred.

Brotherhood is a ransomware group responsible for infecting 18 victims across eight countries including the United States, Australia, and Germany, targeting sectors like Business Services, Public Sector, and Technology.

Who Brotherhood is

Brotherhood is a ransomware group that emerged in late 2025, targeting organizations in the US, Canada, and Australia across manufacturing, communications, and construction sectors, operating a Tor-based double-extortion leak site.

Recorded activity

Disclosures attributed to Brotherhood in this database run from October 2025 to January 2026, totalling 18 victims — 0.1% of everything tracked here. Brotherhood has listed victims in 8 countries in this database, most often United States, followed by Australia and Germany. The sectors appearing most in its listings are Business Services, Public Sector, Technology.

YARA detection rules

brotherhood.yar 
/*
brotherhood ransomware
*/

rule brotherhood_Ransomnote
{
    meta:
        author = "ransomware.live"
        family = "ransomware.brotherhood"
        description = "Detects brotherhood ransomware ransom note or artifact"
        date = "2026-05-04"
        severity = 7
        score = 70

    strings:
        $name1 = "brotherhood" ascii nocase
        $name2 = "BROTHERHOOD" ascii
        $onion  = "brotherhood.onion" ascii nocase

    condition:
        any of them
}

Community-contributed rules for Brotherhood, reproduced as published. Test them against your own corpus before relying on them: rule quality and false-positive behaviour vary by author.

Threat actor analysis

Brotherhood has disclosed 18 victims on its leak site, 0.1% of all ransomware listings tracked in this database. Its earliest disclosure here dates to October 2025.

The group has listed organisations in 8 countries, most often in United States (7 victims), followed by Australia, Germany, Canada.

By industry, its listings concentrate in Business Services, Public Sector, Technology — sectors that hold sensitive data or cannot tolerate long outages, both of which raise the pressure to pay.

Like most current ransomware operations, Brotherhood is likely to use double extortion: data is stolen before files are encrypted, and organisations that refuse to pay are named on the leak site with the stolen data as leverage.

Generated from public leak-site disclosures aggregated via the ransomware.live API and updated automatically.

Brotherhood victims 18

Organization Disclosed
Italgrafica Sistemi
ITItaly
häussermann stauden gehölze gmbh
DEGermany
Ingenieurbüro Laudi
DEGermany
Cera Stribley
AUAustralia
Horst Realty
USUnited States
Kaener Personal
CHSwitzerland
Ninas Jewellery
AUAustralia
Spoleta Construction
USUnited States
Citizens' Committee for Children of New York
USUnited States
Integlia
CACanada
Coal Industry Social Welfare Organisation
GBUnited Kingdom
Kevmor
AUAustralia
Momentum Logistics
ZASouth Africa
Motility Software
USUnited States
Orion Communications and Public Relations
USUnited States
Sternthal Montigny Greenberg St-Germain
CACanada
UVJ Technologies
USUnited States
Woodmen Valley Chapel
USUnited States

Frequently asked questions

What is Brotherhood ransomware?

Brotherhood is a ransomware threat group that has claimed 18 victims since its first known activity in October 2025. The group operates by infiltrating target networks, exfiltrating data, encrypting files, and threatening to publish stolen data on a dark web leak site if the ransom is not paid.

How many victims has Brotherhood attacked?

Brotherhood has claimed 18 victims in our database, representing 0.1% of all tracked ransomware attacks. The most targeted countries are United States, Australia, Germany, Canada.

Which countries does Brotherhood target?

Brotherhood has attacked organizations in 8 countries. The top targeted countries are: United States, Australia, Germany, Canada.

Which industries does Brotherhood target?

Brotherhood most frequently targets the Business Services, Public Sector, Technology sectors based on victim disclosures in our database.

Is Brotherhood still active?

Brotherhood's most recent victim disclosure in our database was on January 6, 2026. Ransomware groups frequently rebrand or go dormant; monitor this page and our ransomware map for the latest activity.