RansomHub
RansomHub was a ransomware-as-a-service (RaaS) variant, previously known as Cyclops and Knight.
L'origine di RansomHub
Emerging in February 2024, the group has encrypted and exfiltrated data from over 210 victims, leveraging high-profile affiliates from other ransomware groups such as LockBit and ALPHV. RansomHub's operation focused on a double extortion model, where affiliates encrypt systems and exfiltrate data, threatening to publish stolen data if ransoms are not paid. The group was known for its professionalism and technical sophistication. RansomHub was last seen in March 2025.
Paesi presi di mira da RansomHub
RansomHub had a global reach, with victims primarily in the United States and Europe, focusing on critical infrastructure and key industries.
The group claimed to avoid targeting the Commonwealth of Independent States (CIS), Cuba, North Korea, and China, likely due to operational safe havens or legal protections.
Settori presi di mira da RansomHub
RansomHub si rivolge a un'ampia gamma di industrie, i cui settori principali sono i servizi alle imprese, il commercio al dettaglio e la produzione. Altri settori frequentemente colpiti sono i servizi educativi, il governo, la finanza, l'edilizia, la sanità, la tecnologia e le infrastrutture critiche. L'attenzione del gruppo per i settori critici evidenzia la sua ampia portata operativa, che rappresenta una minaccia significativa per le entità pubbliche e private.
Nonostante l'efficienza del gruppo, essi affermano di non prendere di mira le organizzazioni non profit.
Vittime di RansomHub
Over 844 organizations have fallen victim to RansomHub since its emergence, with a notable focus on public infrastructure, including healthcare systems and government facilities. These attacks disrupted vital services, leading to significant operational downtimes and substantial ransom demands.
Il metodo di attacco di RansomHub
RansomHub affiliates gained access through phishing emails, exploiting vulnerabilities, and password spraying. Common vulnerabilities exploited include CVE-2023-3519 (Citrix ADC), CVE-2023-27997 (Fortinet), and CVE-2020-1472 (Netlogon privilege escalation).
Once inside, affiliates escalated privileges using tools like Mimikatz, enabling full control over compromised systems.
They disabled security tools, clear logs, and renamed ransomware executables to blend into system files, evading detection.
Using credential dumping tools and password spraying, affiliates gathered administrative credentials to access high-value systems.
Network reconnaissance was conducted using tools like Nmap and PowerShell to identify valuable targets and plan further exploitation.
Affiliates moved laterally using tools like Remote Desktop Protocol (RDP), PsExec, and AnyDesk, gaining access to additional systems within the network.
Sensitive data was exfiltrated using tools like Rclone and WinSCP, often for double extortion purposes, where the stolen data was used as leverage in ransom negotiations.
The ransomware was executed across the victim’s network, encrypting files using Curve 25519 elliptic-curve encryption.
Data was exfiltrated through encrypted protocols, cloud accounts, or direct transfers to attacker-controlled servers.
RansomHub’s encryption rendered victim systems inoperable, often leading to extensive operational downtime. Affiliates deleted backups and volume shadow copies to prevent recovery efforts, maximizing the pressure on victims to pay the ransom.
RansomHub affiliates gained access through phishing emails, exploiting vulnerabilities, and password spraying. Common vulnerabilities exploited include CVE-2023-3519 (Citrix ADC), CVE-2023-27997 (Fortinet), and CVE-2020-1472 (Netlogon privilege escalation).
Once inside, affiliates escalated privileges using tools like Mimikatz, enabling full control over compromised systems.
They disabled security tools, clear logs, and renamed ransomware executables to blend into system files, evading detection.
Using credential dumping tools and password spraying, affiliates gathered administrative credentials to access high-value systems.
Network reconnaissance was conducted using tools like Nmap and PowerShell to identify valuable targets and plan further exploitation.
Affiliates moved laterally using tools like Remote Desktop Protocol (RDP), PsExec, and AnyDesk, gaining access to additional systems within the network.
Sensitive data was exfiltrated using tools like Rclone and WinSCP, often for double extortion purposes, where the stolen data was used as leverage in ransom negotiations.
The ransomware was executed across the victim’s network, encrypting files using Curve 25519 elliptic-curve encryption.
Data was exfiltrated through encrypted protocols, cloud accounts, or direct transfers to attacker-controlled servers.
RansomHub’s encryption rendered victim systems inoperable, often leading to extensive operational downtime. Affiliates deleted backups and volume shadow copies to prevent recovery efforts, maximizing the pressure on victims to pay the ransom.
TTP utilizzati da RansomHub
How to Detect Threat Actors with Vectra AI
DOMANDE FREQUENTI
A quali settori si rivolge principalmente RansomHub?
RansomHub attacca settori di infrastrutture critiche come la sanità, i servizi finanziari e le strutture governative.
Quali sono i Paesi più colpiti da RansomHub?
Il gruppo prende di mira principalmente organizzazioni negli Stati Uniti e in Europa, evitando i Paesi della CSI, Cuba, Corea del Nord e Cina.
Come fa RansomHub a ottenere l'accesso iniziale?
Gli affiliati sfruttano le vulnerabilità note, utilizzano gli attacchi phishing e sfruttano le credenziali rubate per infiltrarsi nei sistemi.
Quali sono i metodi di esfiltrazione dei dati di RansomHub?
Utilizzano strumenti come Rclone e WinSCP per esfiltrare dati sensibili su canali criptati.
Come fa RansomHub ad aumentare i privilegi all'interno di una rete?
Gli affiliati utilizzano strumenti come Mimikatz per estrarre le credenziali e scalare i privilegi a livello di sistema.
Quale metodo di crittografia utilizza RansomHub?
Gli affiliati di RansomHub utilizzano la crittografia a curva ellittica Curve 25519 per bloccare i file delle vittime.
Come fanno gli affiliati di RansomHub a non farsi scoprire?
Disattivano gli strumenti di sicurezza, cancellano i registri e rinominano gli eseguibili del ransomware per confonderli con i file legittimi.
Quali strumenti utilizza RansomHub per gli spostamenti laterali?
Strumenti come Remote Desktop Protocol (RDP), AnyDesk e PsExec sono utilizzati per muoversi lateralmente all'interno di reti compromesse.
Quali strategie di mitigazione possono aiutare a prevenire gli attacchi RansomHub?
L'implementazione di un'autenticazione a più fattori (MFA) resistente a phishing, il patching delle vulnerabilità e la segmentazione delle reti sono strategie di mitigazione fondamentali.
Qual è l'impatto di un attacco RansomHub?
Le vittime spesso subiscono tempi di inattività significativi e perdita di dati a causa della crittografia e della cancellazione dei backup, con conseguente paralisi operativa e richieste di riscatto elevate.