Security Resilience

Threat actor · all actors

br0k3rMISP-d0e15668 criminal

aka br0k3r

Last updated: 2026-10-16

6attributed CVEs
0ATT&CK techniques
12.9IDF score (tooling uniqueness)
0exclusive CVEs
2019–2024years active

About this actor

Br0k3r is not a conventional ransomware gang, but rather an Iran-linked cyber espionage and access brokerage group leveraging its foothold within victim networks to facilitate ransomware operations. Active since around 2017, the group provides privileged domain access—often sold or shared directly—with known ransomware operators such as ALPHV/BlackCat, NoEscape, and RansomHouse, receiving a portion of each successful ransom payout. Victims have included U.S. schools, municipal governments, financial and healthcare organizations, as well as targets in Israel, Azerbaijan, and the UAE. Br0k3r’s strategy merges espionage with criminal collaboration, allowing them to support both state-aligned intelligence objectives and financial incentives.

How we know this

Data origin
MISP threat-actor galaxy Imported from the open-source MISP threat-actor galaxy.
Techniques
No ATT&CK techniques mapped.
Named victims
None on file.

Thin data: No ATT&CK techniques are mapped yet — the behavioural profile is empty.

See how actor data is built for the full pipeline.

Activity timeline

2019: 1 CVE published120192021: 1 KEV added120212022: 1 CVE published2022: 1 KEV added220222023: 1 CVE published2023: 1 KEV added220232024: 3 CVE published2024: 3 KEV added62024
CVE publishedKEV added

Profile

CVERiskCVSSEPSSPublishedProducts
CVE-2024-3400 KEV10.010.01.00002024-04-12see CVE
CVE-2019-19781 KEV9.99.81.00002019-12-27see CVE
CVE-2022-1388 KEV9.99.80.99962022-05-05see CVE
CVE-2023-3519 KEV9.99.80.99752023-07-19see CVE
CVE-2024-21887 KEV9.09.11.00002024-01-12see CVE
CVE-2024-24919 KEV8.88.60.99982024-05-28see CVE

No techniques attributed.

Co-occurring actors

Similar actors

Overlapping CVEs

Active in same years

Same category