RansomHub
RansomHub was a ransomware-as-a-service (RaaS) variant, previously known as Cyclops and Knight.
El origen de RansomHub
Emerging in February 2024, the group has encrypted and exfiltrated data from over 210 victims, leveraging high-profile affiliates from other ransomware groups such as LockBit and ALPHV. RansomHub's operation focused on a double extortion model, where affiliates encrypt systems and exfiltrate data, threatening to publish stolen data if ransoms are not paid. The group was known for its professionalism and technical sophistication. RansomHub was last seen in March 2025.
Países objetivo de RansomHub
RansomHub had a global reach, with victims primarily in the United States and Europe, focusing on critical infrastructure and key industries.
The group claimed to avoid targeting the Commonwealth of Independent States (CIS), Cuba, North Korea, and China, likely due to operational safe havens or legal protections.
Industrias objetivo de RansomHub
RansomHub se dirige a una amplia gama de industrias, siendo los principales sectores los servicios empresariales, el comercio minorista y la industria manufacturera. Otros sectores afectados con frecuencia son los servicios educativos, la administración pública, las finanzas, la construcción, la sanidad, la tecnología y las infraestructuras críticas. El hecho de que el grupo se centre en sectores críticos pone de manifiesto su amplio alcance operativo, que supone una amenaza significativa tanto para entidades públicas como privadas.
A pesar de la eficacia del grupo, afirman no tener como objetivo las organizaciones sin ánimo de lucro.
Víctimas de RansomHub
Over 844 organizations have fallen victim to RansomHub since its emergence, with a notable focus on public infrastructure, including healthcare systems and government facilities. These attacks disrupted vital services, leading to significant operational downtimes and substantial ransom demands.
Método de ataque de RansomHub
RansomHub affiliates gained access through phishing emails, exploiting vulnerabilities, and password spraying. Common vulnerabilities exploited include CVE-2023-3519 (Citrix ADC), CVE-2023-27997 (Fortinet), and CVE-2020-1472 (Netlogon privilege escalation).
Once inside, affiliates escalated privileges using tools like Mimikatz, enabling full control over compromised systems.
They disabled security tools, clear logs, and renamed ransomware executables to blend into system files, evading detection.
Using credential dumping tools and password spraying, affiliates gathered administrative credentials to access high-value systems.
Network reconnaissance was conducted using tools like Nmap and PowerShell to identify valuable targets and plan further exploitation.
Affiliates moved laterally using tools like Remote Desktop Protocol (RDP), PsExec, and AnyDesk, gaining access to additional systems within the network.
Sensitive data was exfiltrated using tools like Rclone and WinSCP, often for double extortion purposes, where the stolen data was used as leverage in ransom negotiations.
The ransomware was executed across the victim’s network, encrypting files using Curve 25519 elliptic-curve encryption.
Data was exfiltrated through encrypted protocols, cloud accounts, or direct transfers to attacker-controlled servers.
RansomHub’s encryption rendered victim systems inoperable, often leading to extensive operational downtime. Affiliates deleted backups and volume shadow copies to prevent recovery efforts, maximizing the pressure on victims to pay the ransom.
RansomHub affiliates gained access through phishing emails, exploiting vulnerabilities, and password spraying. Common vulnerabilities exploited include CVE-2023-3519 (Citrix ADC), CVE-2023-27997 (Fortinet), and CVE-2020-1472 (Netlogon privilege escalation).
Once inside, affiliates escalated privileges using tools like Mimikatz, enabling full control over compromised systems.
They disabled security tools, clear logs, and renamed ransomware executables to blend into system files, evading detection.
Using credential dumping tools and password spraying, affiliates gathered administrative credentials to access high-value systems.
Network reconnaissance was conducted using tools like Nmap and PowerShell to identify valuable targets and plan further exploitation.
Affiliates moved laterally using tools like Remote Desktop Protocol (RDP), PsExec, and AnyDesk, gaining access to additional systems within the network.
Sensitive data was exfiltrated using tools like Rclone and WinSCP, often for double extortion purposes, where the stolen data was used as leverage in ransom negotiations.
The ransomware was executed across the victim’s network, encrypting files using Curve 25519 elliptic-curve encryption.
Data was exfiltrated through encrypted protocols, cloud accounts, or direct transfers to attacker-controlled servers.
RansomHub’s encryption rendered victim systems inoperable, often leading to extensive operational downtime. Affiliates deleted backups and volume shadow copies to prevent recovery efforts, maximizing the pressure on victims to pay the ransom.
TTPs utilizados por RansomHub
How to Detect Threat Actors with Vectra AI
Preguntas frecuentes
¿A qué sectores se dirige principalmente RansomHub?
RansomHub ataca sectores de infraestructuras críticas como la sanidad, los servicios financieros y las instalaciones gubernamentales.
¿Cuáles son los países más afectados por RansomHub?
El grupo se dirige principalmente a organizaciones de Estados Unidos y Europa, evitando los países de la CEI, Cuba, Corea del Norte y China.
¿Cómo obtiene RansomHub el acceso inicial?
Los afiliados explotan vulnerabilidades conocidas, utilizan ataques a phishing y aprovechan credenciales robadas para infiltrarse en los sistemas.
¿Cuáles son los métodos de exfiltración de datos de RansomHub?
Utilizan herramientas como Rclone y WinSCP para filtrar datos confidenciales a través de canales cifrados.
¿Cómo aumenta RansomHub los privilegios dentro de una red?
Los afiliados utilizan herramientas como Mimikatz para extraer credenciales y escalar a privilegios a nivel de sistema.
¿Qué método de cifrado utiliza RansomHub?
Los afiliados a RansomHub utilizan el cifrado de curva elíptica Curve 25519 para bloquear los archivos de las víctimas.
¿Cómo evitan ser detectados los afiliados a RansomHub?
Desactivan las herramientas de seguridad, borran los registros y cambian el nombre de los ejecutables del ransomware para confundirlos con archivos legítimos.
¿Qué herramientas utiliza RansomHub para el movimiento lateral?
Herramientas como Remote Desktop Protocol (RDP), AnyDesk y PsExec se utilizan para moverse lateralmente dentro de redes comprometidas.
¿Qué estrategias de mitigación pueden ayudar a prevenir los ataques de RansomHub?
La implantación de una autenticación multifactor (AMF) resistente a phishing, la aplicación de parches a las vulnerabilidades y la segmentación de las redes son estrategias de mitigación clave.
¿Cuál es el impacto de un ataque RansomHub?
Las víctimas suelen sufrir importantes periodos de inactividad y pérdidas de datos debido al cifrado y a la eliminación de las copias de seguridad, lo que provoca una parálisis operativa y elevadas peticiones de rescate.