Loading malware…
RansomHub is a cross-platform ransomware family and financially motivated ransomware-as-a-service operation that emerged in February 2024. Its payloads target Windows, Linux, and VMware ESXi environments. RansomHub shares substantial Go code, Gobfuscate-based obfuscation, command-line functionality, and ransom-note wording with Knight ransomware, previously known as Cyclops. These technical similarities establish code lineage but do not establish continuity between the operations’ owners.
RansomHub encrypts victim data and supports restarting Windows endpoints in Safe Mode before encryption. Its operators practice double extortion, combining encryption with threats to publish stolen information. The platform does not include a built-in data-exfiltration component; affiliates independently select tools and infrastructure for stealing data. Affiliates have also used EDRKillShifter to disable endpoint security through vulnerable-driver exploitation before deploying the ransomware, rather than through an intrinsic encryptor capability.
Affiliate intrusion methods include phishing, password spraying, and exploitation of known vulnerabilities in enterprise systems and remote-access infrastructure. SocGholish infections delivered through fake browser updates have also enabled access for RansomHub affiliates. Intrusions commonly involve credential harvesting, network reconnaissance, legitimate remote-management software, and lateral movement before encryption. Associated actors include the operator tracked as Greenbottle and affiliates linked to Scattered Spider and former ALPHV/BlackCat activity. The affiliate program offered attackers 90% of ransom proceeds, with payments routed to affiliates before the platform received its share.
RansomHub has affected organizations worldwide, including manufacturing, healthcare, professional services, construction, retail, technology, finance, and government. Its leak site and victim communication infrastructure went offline on April 1, 2025; the cause and permanence of that interruption were not established.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
11 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Attackers deploying RansomHub have been seen gaining initial access to victim networks by exploiting known vulnerabilities such as the Zerologon vulnerability (CVE-2020-1472).
CitrixBleed (CVE-2023-3519): This exploit for known vulnerabilities is frequently used by RansomHub affiliates, which security researchers with Microsoft reported have shifted to using Ransomhub and Qilin ransomware operations.
The article lists “Fortinet FortiOS (CVE-2023-27997)” among known vulnerabilities exploited for initial access by attackers deploying RansomHub.
Confluence (CVE-2023-22515): This exploit is also frequently used by RansomHub affiliates.
The article lists “Java OpenWire protocol marshaller (CVE-2023-46604)” among known vulnerabilities exploited for initial access by attackers deploying RansomHub.
CVEs exploited by RansomHub: BIG-IP (CVE-2023-46747). | According to the Cybersecurity and Infrastructure Security Agency (CISA), the RansomHub ransomware-as-a-service (RaaS) platform does not provide built-in mechanisms for data exfiltration.
CVEs exploited by RansomHub: SMBv1 (CVE-2017-0144). | According to the Cybersecurity and Infrastructure Security Agency (CISA), the RansomHub ransomware-as-a-service (RaaS) platform does not provide built-in mechanisms for data exfiltration.
CVEs exploited by RansomHub: FortiClientEMS (CVE-2023-48788). | According to the Cybersecurity and Infrastructure Security Agency (CISA), the RansomHub ransomware-as-a-service (RaaS) platform does not provide built-in mechanisms for data exfiltration.
Persistence via new systemd services is a TTP documented in multiple ransomware groups, including RansomHub's campaigns using CVE-2024-1086 for post-compromise privilege escalation.
Ransomware groups—including BlackCat/ALPHV, Black Basta, RansomHub, and Dark Angels—are increasingly targeting VMware ESXi...
Fortinet FortiOS CVE-2024-55591, a zero-day authentication bypass vulnerability disclosed in January 2025, had the highest count of ransomware groups attached to it as the year closed, with six named ransomware families (DragonForce, Hunters International, NightSpire, Qilin, RansomHub, and SuperBlack)...
11 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Scattered Spider rented its access out to whichever ransomware brand was ascendant: ALPHV/BlackCat in 2023, RansomHub through late 2024 and into 2025, and DragonForce in the 2025 wave against UK retailers.
“This blog entry focuses on a cluster that deploys backdoor components to enable initial access for RansomHub ransomware-as-a-service (RaaS) affiliates.”
According to the Cybersecurity and Infrastructure Security Agency (CISA), the RansomHub ransomware-as-a-service (RaaS) platform does not provide built-in mechanisms for data exfiltration.
RansomHub first appeared in February 2024, and by the third quarter of the year, it was one of the most prominent ransomware operations.
ShadowSyndicate works with numerous ransomware groups and affiliates of ransomware programs including RansomHub
The user @dragonforce ... stated, “It has been decided that RansomHub’s infrastructure will be transferred to DragonForce, and the two groups are in a partnership.”
21 distinct techniques documented for this family, organized by ATT&CK tactic.
42 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
154 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Ransomware associated with Scattered Spider's affiliate operations through late 2024 and into 2025. The article emphasizes that the ransomware brand changed while the underlying social-engineering and initial-access tradecraft persisted.
A ransomware-as-a-service platform mentioned only as a comparison for affiliate compensation and recruitment. The content says it attracted affiliates from competitors early in its operation; it does not connect RansomHub operationally to the dispute or the new platform.
Mentioned as a source of affiliates subsequently absorbed by Qilin, without details of its own malware or campaigns.
Mentioned as background to disputes among ransomware operators. No ransomware capabilities or victim attack details are provided.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.