brotherhood

Executive Summary

The Brotherhood is a medium-sophistication ransomware group targeting US, Canada, and Australia across manufacturing, communications, and construction sectors. They use Tor-based double-extortion tactics, marking them as a growing threat to critical infrastructure and financial interests.

Goals & Targeting

The Brotherhood targets sectors with high infrastructure value and data-sensitive industries to maximize financial gains. Their geographic spread across US, Canada, and Australia suggests a strategy to diversify attacks and reduce detection risks.

The Brotherhood emerged in late 2025, operating in the US, Canada, and Australia, focusing on制造业，通信和建筑行业。他们采用双 extortion策略，使用Tor网站作为沟通渠道，对受害者施加压力以获取赎金。该组织已知有18个受害者，显示出其在运营上的一定能力。

Key Capabilities

• Ransomware deployment
• Double extortion tactics
• Phishing campaigns

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

The Brotherhood operates with a steady tempo, targeting mid-sized to large organizations in their sectors. Their campaigns involve spear-phishing and malicious links distribution. Notable operations include multiple attacks in manufacturing and communications spaces.

IOC Patterns

• Spear phishing emails
• Malicious Tor traffic
• Ransomware binaries

Recommended Actions

• Enhance email filtering
• Educate employees on phishing
• Monitor network for extortion attempts

Suggested Tags