Full Report
Learn why RansomHub's new affiliate program and its advanced ransomware tactics—recruiting former Scattered Spider members, exploiting unprotected RDP services, and exfiltrating large data volumes—are critical for staying ahead of modern cyber threats.
Analysis Summary
# Threat Actor: RansomHub
## Attribution & Identity
* **Actor Name:** RansomHub
* **Aliases/Associations:**
* Functions as a Ransomware-as-a-Service (RaaS) affiliate program.
* Known to have recruited former members of **Scattered Spider** (UNC3944).
* Associated with former affiliates of defunct or fractured groups such as **ALPHV (BlackCat)** and **LockBit**, following recent law enforcement disruptions of those operations.
## Activity Summary
RansomHub emerged as a significant threat in early 2024, rapidly scaling its operations by positioning itself as a "stable" alternative for displaced affiliates. The group gained notoriety for its aggressive recruitment of high-tier cybercriminals and its involvement in high-profile data exfiltration incidents. They utilize a sophisticated affiliate panel and have been observed conducting rapid-fire campaigns targeting organizations globally, often characterized by the exfiltration of massive volumes of data (exceeding 300 GB) before deploying encryption.
## Tactics, Techniques & Procedures
* **Initial Access:** Exploitation of unprotected or poorly secured Remote Desktop Protocol (RDP) services; acquisition of credentials from initial access brokers.
* **Credential Access:** Use of compromised user accounts and targeting external remote services lacking robust MFA.
* **Lateral Movement & Discovery:** Utilization of "dual-use" tools (legitimate administrative tools repurposed for malicious intent).
* **Exfiltration:** Large-scale data theft prior to encryption.
* **Extortion:** Double extortion (encryption of data and threat of public release on a dedicated leak site).
* **MITRE ATT&CK IDs:**
* **T1133:** External Remote Services
* **T1021.001:** Remote Services: Remote Desktop Protocol
* **T1078:** Valid Accounts
* **T1041:** Exfiltration Over C2 Channel
## Targeting
* **Sectors:** General industry targeting with a focus on data-rich environments; no specific vertical exclusions mentioned.
* **Geography:** Global reach (implied by the recruitment of international affiliates like Scattered Spider).
* **Victims:** Known for targeting large organizations capable of paying high ransoms; specific mentions include entities previously targeted by their recruited affiliates.
## Tools & Infrastructure
* **Malware:** RansomHub ransomware (written in Go/Golang or C++ depending on the version/affiliate).
* **Infrastructure:**
* Dedicated leak sites (DLS) hosted on the TOR network.
* Affiliate management panels.
* **Dual-Use Tools:** Various legitimate tools for network scanning and lateral movement (often added to allow-lists by unsuspecting admins).
* **Data Exfiltration Tools:** Custom scripts or common tools like Rclone for moving data to cloud storage.
## Implications
RansomHub represents a shift in the RaaS landscape where "brand loyalty" is decreasing, and affiliates move toward platforms offering better terms and lower law enforcement visibility. The inclusion of Scattered Spider members increases the threat level due to their expertise in social engineering and bypassing complex security controls. The group's focus on massive data exfiltration means that even if encryption is prevented, the risk of a significant data breach remains high.
## Mitigations
* **MFA Implementation:** Enforce one-time password (OTP) based multi-factor authentication for all external remote services.
* **RDP Security:** Disable or strictly limit RDP access; ensure it is only accessible via VPN.
* **Network Monitoring:** Monitor for significant network spikes (e.g., >300 GB) to external resources, which may indicate exfiltration.
* **Asset Management:** Use Attack Surface Management (ASM) to discover exposed assets and compromised accounts.
* **Tool Governance:** Do not "allow-list" dual-use tools; monitor their usage via EDR telemetry and group events by logon type and process tree.
* **Backup Integrity:** Maintain offline, immutable backups and conduct regular ransomware readiness assessments.