Loading threat actor…
RansomHub, also tracked as Spoiled Scorpius, is a financially motivated ransomware-as-a-service operation that emerged in February 2024. Its core operators supply ransomware and supporting infrastructure, while affiliates compromise networks, steal data, and deploy encryption payloads. The program offered affiliates 90% of ransom proceeds, with payments going to affiliates before the operators received their share. RansomHub recruited affiliates from disrupted operations, including ALPHV/BlackCat, and became one of the most prolific ransomware operations of 2024. It targets organizations internationally, particularly in the United States, across manufacturing, healthcare, professional services, construction, retail, finance, technology, telecommunications, and government. Affiliates obtain initial access through phishing, password spraying, and exploitation of known vulnerabilities, including Zerologon (CVE-2020-1472). Intrusions involve network scanning, credential harvesting with Mimikatz, account creation or reactivation, scheduled-task persistence, privilege escalation, and lateral movement using remote-management software and tools such as PsExec and Cobalt Strike. Affiliates independently select data-exfiltration methods, using utilities and services including Rclone, WinSCP, SSH tunneling, and cloud storage. RansomHub actors have also used EDRKillShifter to disable security products through bring-your-own-vulnerable-driver exploitation before ransomware deployment. RansomHub uses encryption and stolen-data publication threats for double extortion and has also pursued extortion over previously stolen data. Its ransomware supports Windows, Linux, and VMware ESXi environments and shares substantial code and operational features with Knight ransomware, originally known as Cyclops; this technical lineage does not establish continuity of the operators. Notable activity includes the April 2024 Frontier Communications breach and extortion involving Change Healthcare. Its leak site and victim communication infrastructure went offline around April 1, 2025, and subsequent monitoring recorded no leak-site posting activity after early April 2025. The cause of the disruption and any permanent organizational shutdown remain unconfirmed.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
59 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
6 malware families attributed to this actor across reporting.
1 additional family tracked in Mallory.
8 CVEs this actor has used in observed campaigns. 8 of them exploited in the wild.
CVEs exploited by RansomHub: Netlogon Remote Protocol (CVE-2020-1472); Net logon (CVE-2020-1472).
CVEs exploited by RansomHub: Confluence Data Center and Server (CVE-2023-22515/Groma Explorer).
CVEs exploited by RansomHub: FortiOS (CVE-2023-27997/Groma Explorer).
CVEs exploited by RansomHub: Citrix NetScaler ADC (CVE-2023-3519).
CVEs exploited by RansomHub: SMBv1 (CVE-2017-0144).
3 more CVEs tied to this actor tracked in Mallory.
3 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Identified as responsible for the April 2024 breach of Frontier Communications, which compromised sensitive personal information. The article reports a $625,000 settlement between Frontier and Connecticut Attorney General William Tong following an investigation into the breach.
Mentioned as a comparison for The Gentlemen's affiliate terms. RansomHub reportedly offered the same favorable revenue split and attracted affiliates from competing operations early in its existence.
Mentioned only as an operation whose affiliates subsequently joined Qilin; no specific RansomHub activity is described.
Its site was taken down during a background incident involving rival groups. A member subsequently defaced DragonForce's site and labeled that group 'traitors.'
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.