Br0k3r

Br0k3r is an online persona used by the Pioneer Kitten cluster to advertise and sell network access to ransomware affiliate groups on cybercriminal forums. Active since at least 2023, the persona operates on dark web forums offering access to compromised enterprise networks — particularly those gained through VPN vulnerability exploitation — to ransomware operators including ALPHV/BlackCat and Ransomhouse. The US FBI and CISA explicitly referenced this access-brokering activity in their August 2024 advisory formally attributing Pioneer Kitten to an Iranian government-linked entity, noting the group's collaboration with ransomware actors as both financially and strategically motivated.