RansomHub

Description

RansomHub is a ransomware operation that rose rapidly in 2024, staffed by affiliates from retired brands and renting its encryptor to experienced intrusion crews. It targets Windows, Linux, and VMware ESXi systems, exfiltrates data before encryption, and pressures victims through a leak site and aggressive negotiation. Its affiliate model and broad platform support made it one of the most active extortion brands of its era.

Stats

First seen: June 2024
Last seen: October 2026

Also known as

Ransomhub

MITRE ATT&CK techniques

21 techniques across 8 tactics.

TA0002 Execution

T1059Command and Scripting Interpreter
- T1059.001PowerShell
- T1059.003Windows Command Shell

TA0003 Persistence

T1547Boot or Logon Autostart Execution
- T1547.001Registry Run Keys / Startup Folder

TA0005 Stealth

T1027Obfuscated Files or Information
- T1027.013Encrypted/Encoded File
T1070Indicator Removal
- T1070.004File Deletion
T1140Deobfuscate/Decode Files or Information
T1480Execution Guardrails
T1497Virtualization/Sandbox Evasion
- T1497.003Time Based Checks

TA0007 Discovery

T1018Remote System Discovery
T1057Process Discovery
T1082System Information Discovery
T1083File and Directory Discovery
T1135Network Share Discovery

TA0008 Lateral Movement

T1021Remote Services
- T1021.002SMB/Windows Admin Shares

TA0011 Command and Control

T1090Proxy

TA0040 Impact

T1486Data Encrypted for Impact
T1489Service Stop
T1490Inhibit System Recovery
T1491Defacement
- T1491.001Internal Defacement

TA0112 Defense Impairment

T1685Disable or Modify Tools
- T1685.005Clear Windows Event Logs
T1688Safe Mode Boot

Alert name variants

Alert Name	Engine
Gen:Variant.Ransom.RansomHub.1	AV
Linux.Ransomware.Ransomhub	ATP Sandbox Adv. Heuristics
Win32.Ransomware.Ransomhub	ATP Sandbox Adv. Heuristics
Win64.Ransomware.Ransomhub	ATP Sandbox Adv. Heuristics
Win64.Ransomware.RansomHub	ATP Sandbox Adv. Heuristics

Related IPS Signatures

Signature Name	Engine
MALWARE-OTHER Win.Ransomware.RansomHub variant download attempt	IPS-SWG