br0k3r
- First seen
- 2017-01-01 00:00:00
- Malware type
- ransomware, spyware
- Family
- Malware family
- Profile updated
- 2026-07-07 13:54:52
Targeted industries: education-and-nonprofits government-and-public-sector financial-services healthcare-and-pharmaceutical
Targeted regions: country_code:us country_code:il country_code:az country_code:ae
Context
Br0k3r is not a conventional ransomware gang, but rather an Iran-linked cyber espionage and access brokerage group leveraging its foothold within victim networks to facilitate ransomware operations. Active since around 2017, the group provides privileged domain access—often sold or shared directly—with known ransomware operators such as ALPHV/BlackCat, NoEscape, and RansomHouse, receiving a portion of each successful ransom payout. Victims have included U.S. schools, municipal governments, financial and healthcare organizations, as well as targets in Israel, Azerbaijan, and the UAE. Br0k3r’s strategy merges espionage with criminal collaboration, allowing them to support both state-aligned intelligence objectives and financial incentives.
Reports & references
- ransomlook.io — Br0K3R (report)
- CISA — Aa24 241A (report)
- helpnetsecurity.com — Pioneer Kitten Iranian Hackers Partnering With Ransomware Affiliates (report)
- anvilogic.com — Iranian Cyber Groups Ransomware (report)