RansomHubThreat actor
RansomHub is a rapidly growing ransomware group believed to be an updated version of the older Knight ransomware. They have been linked to attacks exploiting the Zerologon vulnerability to gain initial access. RansomHub has attracted former affiliates of the ALPHV ransomware group and operates as a Ransomware-as-a-Service with a unique affiliate prepayment model.From MISP Galaxy
Last reported 3 days ago, by Infosecurity Magazine23 reports
ATT&CK techniques
6 of 105 · each with the sentence it comes from- T1027Obfuscated Files or Information
“T1027 Obfuscated Files or Information”
- T1685Disable or Modify Tools
“T1562.001 Impair Defenses: Disable or Modify Tools”
- T1059Command and Scripting Interpreter
“T1059.001 Command and Scripting Interpreter: PowerShell”
- T1059.003Windows Command Shell
“T1059.003 Command and Scripting Interpreter: Windows Command Shell”
- T1684Social Engineering
“…ckCat operates as a Ransomware-as-a-Service (RaaS) with affiliates adopting whatever intrusion techniques yield results, including social engineering and malvertising.”
- T1014Rootkit
“…tep involved the upload of a tool known as PCHunter, a small all-in-one toolkit utility developed to spot and remove malware, including rootkits, which allows access to various system settings such as kernels and kernel modules, processes, network, startup and a whole lot more.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
23 reports · the newest 20, newest first · the exact sentence from each-
Ransomware Attacks Rise as Rival Gangs Vie For Market Supremacy“Researchers suggested that the action against the likes of Lockbit, BlackCat and RansomHub helped to reduce ransomware activity during 2025.”
-
Attorney General Tong Announces $625,000 Settlement with Frontier Over Data Breach“The press release below relates to a 2024 breach of Frontier Communications by RansomHub: Attorney General William Tong today announced a $625,000 settlement with Frontier Communications Parent Inc., resolving an investigation into an April 2024 data breach that compromised the s…”
-
From ‘High/Medium/Low’ to Dollars: Making Cyber Risk Legible to Your CFO“International disruption operations targeted several ransomware ecosystems, but as RansomHub went offline in April 2025 and Black Basta became largely inactive following internal chat leaks and operational disputes, displaced affiliates migrated between operators and adopted dist…”
-
Ransomware in 2026: Same Business, New Rules“RansomHub’s infrastructure went dark and DragonForce publicly claimed it had joined its cartel.”
-
Every Ransomware Attack Has a Backstory“Four groups—Akira, Medusa, Qilin, and RansomHub—drove 51.3% of all ransomware incidents in 2025.”
-
GentleKiller: análisis del framework EDR killer de Gentlemen“Un caso notable es RansomHub, que invirtió en desarrollar su propio EDR killer desde cero, EDRKillShifter, y luego lo ofreció a los afiliados a través del panel de afiliados.”
-
Interlock Ransomware: Evolving Under the Radar with ClickFix“Indeed, ransomware such as Clop, RansomHub, Akira, Babuk, Lynx, Qilin, and Fog, each claimed more than one hundred victims in the first quarter of 2025.”
-
Cyber Threat Actors Impacting the Financial Sector in 2024“Ransomware and extortion groups like RansomHub and Scattered Spider ran advanced double-extortion campaigns against finance.”
-
El back office del ransomware: la industria que la nota de rescate no muestra“…cuando LockBit y BlackCat fueron desarticulados por las fuerzas del orden en 2024, sus afiliados se trasladaron en su mayoría a RansomHub.”
-
What the ransom note won’t say“For example, when LockBit and BlackCat were disrupted by law enforcement in 2024, their affiliates moved mainly to RansomHub.”
-
EDR killers explicados: Más allá de los drivers“En 2025, los investigadores de ESET publicaron un análisis de EDRKillShifter, un EDR killer desarrollado por los operadores de RansomHub y ofrecido directamente a sus afiliados.”
-
EDR killers explained: Beyond the drivers“In 2025, ESET researchers published an analysis of EDRKillShifter, an EDR killer developed by RansomHub operators and offered directly to their affiliates.”
-
Time to Ransom is Money“Actors like Play and RansomHub, for instance, go into an environment knowing exactly what they need to do to move as quickly as possible.”
-
Ransomware debris: an analysis of the RansomHub operation“Ransomware debris: an analysis of the RansomHub operation”
-
The beginning of the end: the story of Hunters International“Similar to Black Suit, Qilin, RansomHub, and other ransomware groups, Hunters International has also attacked the healthcare industry, following a trend in 2024 that saw a significant increase in intrusions against healthcare companies and institutions.”
-
RansomHub Never Sleeps Episode 1: The evolution of modern ransomware“RansomHub Never Sleeps Episode 1: The evolution of modern ransomware”
-
2025 Cybersecurity Threat Report“Groups like RansomHub and Akira now incentivize stolen data with big rewards, making these tactics quite lucrative.”
-
Top 3 Cybersecurity Threats of 2024 (So Far)“In the past six months alone, BYOVD has been at the center of several widespread attacks by notorious groups like Kasseika, RansomHub, Cuba, GhostLocker, INC, Rhysida, and Medusa.”
-
RansomHub ransomware-as-a-service“RansomHub ransomware-as-a-service”
-
BlackCat Ransomware: Tactics, Techniques & Mitigation Strategies“The affiliate then worked with another ransomware group, RansomHub, which attempted to extort Change Healthcare further.”
Indicators in its reports
named in the reports above- 82ed942a52cdcf12…ba37619661a3in 3 reports
- 54547180a99474b0…8f3eea78b531in 2 reports
- 75f85caea52fe5a1…bd3161690addin 2 reports
- 002573d80091f7f8…2b85fa915f19in 2 reports
- 1e7567c0d525ad03…f40541994411in 2 reports
- 65c2388b0afb1d1f…d8d6cd8b5645in 2 reports
- a9f37104d2d89051…bff44d147e67in 2 reports
- 083f604377d74c43…e34ad7daceeain 2 reports
- 570161a420992280…800296b72d1cin 2 reports
- bbe0e14bc7ece8a7…0476cfcef110in 2 reports
- 31ce76931ca09d39…3bc72e6d647ein 2 reports
- b9820bf443c37557…e3a569a1b9e8in 2 reports
- 34270b07538b7357…8f234b602f93in 2 reports
- 09735640d6634b03…bc80f932126cin 2 reports
Copy these 14 indicators · defanged
Thanks — we review every report.