Full Report
This blog on RansomHub provides an overview into how this Ransomware-as-a-Service (RaaS) group operates, including its extortion tactics, affiliate recruitment strategies, and the features of its affiliate panel.
Analysis Summary
# Threat Actor: RansomHub
## Attribution & Identity
* **Actor Type:** Ransomware-as-a-Service (RaaS) provider.
* **Aliases/Associated Groups:**
* Linked to former affiliates of **LockBit**, **ALPHV (BlackCat)**, and **NoEscape**.
* Observed TTP overlaps with **Knight ransomware** (due to code similarities).
* Associated with a "big company" data disclosure previously linked to ALPHV.
* Recent potential migration of affiliates to **Qilin** (following a period of RansomHub downtime).
## Activity Summary
RansomHub emerged as a significant player by capitalizing on law enforcement disruptions and exit scams affecting major RaaS groups. They launched an aggressive recruitment campaign on underground forums (such as RAMP), positioning themselves as a stable alternative with a highly favorable financial model for affiliates.
## Tactics, Techniques & Procedures
* **Affiliate Model:** Offers a low 10% fee to affiliates (affiliates keep 90%), significantly lower than the industry standard.
* **Extortion Tactics:** Employs a double-extortion model (data encryption and data leak threats).
* **Service Termination:** Features capabilities to kill specific processes and services to ensure successful encryption.
* **Inhibiting Recovery:** Deletes Windows Shadow Copies and Virtual Machine (VM) snapshots.
* **Lateral Movement/Discovery:** Automated discovery and encryption of both local and remote file systems.
* **MITRE ATT&CK IDs:**
* **T1486:** Data Encrypted for Impact
* **T1490:** Inhibit System Recovery
* **T1083:** File and Directory Discovery
* **T1046:** Network Service Scanning
## Targeting
* **Sectors:** Indiscriminate; targets a wide range of industries, though the article highlights a high-profile disclosure involving a large corporation previously targeted by ALPHV.
* **Geography:** Global operations.
* **Victims:** Specifically mentions attracting affiliates who bring data from organizations previously breached by other groups (e.g., the Change Healthcare/ALPHV incident fallout).
## Tools & Infrastructure
* **Malware Families:** RansomHub Ransomware (written in Go/Golang or C++, showing modular features).
* **Infrastructure:**
* **Affiliate Panel:** A centralized dashboard for affiliates to manage victims, chat with targets, and customize ransomware builds.
* **Data Leak Site:** Hosted on the Tor network for publicizing non-compliant victims.
* **C2/Communication:** Utilizes the RAMP forum for recruitment and support.
## Implications
RansomHub represents a "refugee" group that gains power by absorbing displaced high-tier cybercriminals. Their success underscores that RaaS market share is highly fluid; law enforcement action against one group often results in the immediate strengthening of another. Their competitive financial terms (10% commission) suggest a strategic move to commoditize ransomware services further.
## Mitigations
* **Backup Integrity:** Maintain offline, encrypted, and immutable backups to counter the deletion of Shadow Copies and snapshots.
* **Service Hardening:** Monitor for unauthorized attempts to stop critical security services or database processes.
* **Access Control:** Implement the principle of least privilege (PoLP) and segment networks to prevent the encryption of remote file systems.
* **Vulnerability Management:** Prioritize patching of edge devices, as RaaS affiliates frequently use known exploits for initial access.
* **Endpoint Protection:** Deploy EDR/XDR solutions capable of detecting Golang-based payloads and behavior-based encryption patterns.