Table of Contents
March 4, 2025
|9m
RansomHub Ransomware-as-a-Service (RaaS) Group
RansomHub is a rapidly growing Ransomware-as-a-Service (RaaS) threat actor that emerged in early 2024. Despite its relatively recent appearance, it has quickly become a significant player in the cybercrime landscape, impacting numerous organizations globally. RansomHub operates by providing ransomware tools and infrastructure to affiliates, who then carry out attacks and share a portion of the ransom proceeds. The group employs a double extortion model, encrypting victims' data and exfiltrating sensitive information, threatening to publish the stolen data if the ransom is not paid. This profile delves into the origins, tactics, targets, and defenses against RansomHub, providing crucial information for security professionals.
Origins & Evolution
RansomHub first appeared in February 2024 and has quickly gained prominence. The group is believed to be linked to the older Knight ransomware (which itself was based on Cyclops ransomware), having potentially purchased and repurposed the Knight source code. This is supported by similarities in code, encryption algorithms, and the timing of the Knight source code sale.
RansomHub's rapid rise is largely attributed to its strategic recruitment of affiliates. It capitalized on the law enforcement takedown of LockBit, attracting former LockBit affiliates. More significantly, RansomHub targeted disgruntled affiliates of ALPHV/BlackCat after that group allegedly scammed its own partners. This opportunistic recruitment provided RansomHub with experienced cybercriminals, accelerating its growth and operational capabilities.
RansomHub explicitly states that its affiliates are restricted from attacking CIS countries (Commonwealth of Independent States, primarily former Soviet Union countries), Cuba, North Korea, and China. This restriction strongly suggests a potential base of operations in Russia or a country with close ties to Russia, as avoiding these regions often provides a degree of protection from local law enforcement.
Tactics & Techniques
RansomHub employs a wide range of tactics, techniques, and procedures (TTPs), demonstrating a sophisticated understanding of both offensive and defensive cyber operations. Their attack chain typically follows these stages:
Initial Access:
Phishing and Spear-phishing: They use social engineering techniques, including spear-phishing voice (vishing) with American-accented speakers, to trick individuals into providing credentials or installing malware. [T1566.004]
Exploitation of Known Vulnerabilities: RansomHub aggressively exploits known vulnerabilities in various systems, including: [T1190]
* CVE-2023-3519 (Citrix ADC Remote Code Execution)
* CVE-2023-27997 (FortiOS SSL-VPN heap-based buffer overflow)
* CVE-2023-46604 (Apache ActiveMQ Remote Code Execution)
* CVE-2023-22515 (Confluence Data Center and Server unauthorized administrator account creation)
* CVE-2023-46747 (BIG-IP system arbitrary system commands execution)
* CVE-2023-48788 (Fortinet FortiClientEMS SQL injection)
* CVE-2017-0144 (Windows SMB Remote Code Execution Vulnerability)
* CVE-2020-1472 (Netlogon Remote Protocol (MS-NRPC) vulnerability)
* CVE-2020-0787 (Zerologon privilege escalation vulnerability)
* CVE-2024-3400 (Palo Alto Networks PAN-OS devices).
Compromised VPN Accounts: They leverage stolen or compromised VPN credentials. [T1078]
Password Spraying and Brute Force: Attempts to gain access through brute-force attacks and password spraying, particularly targeting domain controllers. [T1110][T1110.003]
Execution and Lateral Movement:
PowerShell: Heavily utilizes PowerShell for various tasks, including credential access, remote system discovery, enabling SSH, and downloading/installing remote access tools. [T1059.001]
Python: Employs customized Python scripts, particularly for targeting ESXi servers, transferring the encryptor, and executing it across multiple virtual machines. [T1059.006]
Windows Command Shell: Uses the command shell for various tasks, and the ransomware binary accepts command-line parameters for customization. [T1059.003]
Remote Access Tools: Utilizes legitimate remote access tools like Atera, Splashtop, and AnyDesk for persistence and control. AnyDesk installations are often automated and silently configured. [T1219]
SSH: Configures SSH on ESXi hosts for remote access. [T1021.004]
Lateral Tool Transfer: Utilizes
xcopy/copyto transfer binaries and drivers for disabling AV. [T1570]Ingress Tool Transfer: Uses SFTP to transfer the encryptor. [T1105]
Network Scanning: Uses NetScan to scan the network. [T1046]
Defense Evasion:
Registry Modification: Aggressively removes registry keys related to Windows Defender and other security features. [T1112]
Obfuscated Files or Information: Uses an encrypted configuration file, decrypted at runtime with a 32-byte passphrase. [T1027.013]
Hidden Window: Hides the console window to avoid detection. [T1564.003]
Clear Windows Event Logs: Clears security, system, and application logs using
wevtutiland a batch file (LogDel.bat). [T1070.001]Impair Defenses: Uses
SetErrorModeto suppress error messages. [T1562.006]Windows File and Directory Permissions Modification: Modifies symbolic link behavior. [T1222.001]
Safe Mode Boot: Can reboot the system into Safe Mode with Networking to bypass security software. [T1562.009]
Execution Guardrails: Requires a specific 32-byte passphrase for execution. [T1480]
Boot or Logon Autostart Execution: Adds registry entries to execute on reboot with safeboot. [T1547.001]
Credential Access:
OS Credential Dumping: Employs various credential dumping techniques, including: [T1003]
* Dumping credentials from the Veeam database.
* Extracting the NTDS.dit file. [T1003.003]
* Dumping credentials from LSASS memory. [T1003.001]
Credentials from Password Stores: Uses PowerShell scripts to interact with CyberArk PAS to extract account information. [T1555.005]
Discovery:
Process Discovery: Identifies and terminates specific processes, particularly AV and security-related processes. [T1057]
System Information Discovery: Enumerates drives and determines drive types. [T1082]
File and Directory Discovery: Searches for files to encrypt, avoiding specific whitelisted files and folders. [T1083]
Account Discovery: Enumerates local accounts. [T1087.001]
Network Share Discovery: Discovers and encrypts shared resources. [T1135]
Impact:
Data Encrypted for Impact: Encrypts data using ECDH and AES, appending the master public key as a file extension. A random 6-digit alphanumeric file extension is added after encryption. [T1486]
Inhibit System Recovery: Deletes shadow copies using PowerShell to prevent recovery. [T1490]
Service Stop: Stops virtual machines, IIS services, and other services. [T1489]
System Shutdown/Reboot: Reboots systems, particularly when using the
-safebootargument. [T1529]
Targets or Victimology
RansomHub exhibits opportunistic targeting, attacking organizations across a wide range of industries and geographic locations. However, there are some notable patterns:
Critical Infrastructure: They have targeted critical infrastructure sectors, including water and wastewater, IT, government services, healthcare, food and agriculture, financial services, commercial facilities, critical manufacturing, transportation, and communications.
Geographic Distribution: While their attacks are global, a significant number of victims are located in the United States. Other heavily targeted countries include India, Brazil, Mongolia, Colombia, Egypt, and Israel.
Small and Medium-Sized Enterprises (SMEs): A large percentage (67%) of RansomHub victims are SMEs.
Double Extortion: RansomHub consistently employs double extortion, threatening to publish stolen data if the ransom is not paid.
Attack Campaigns
Several notable attack campaigns have been attributed to RansomHub:
Change Healthcare (Re-extortion): After Change Healthcare was initially attacked by ALPHV/BlackCat, RansomHub later claimed to have stolen data from the company and demanded a second ransom from insurance companies, threatening to leak sensitive medical and financial information.
Christie's Auction House: RansomHub claimed responsibility for an attack on the renowned auction house, resulting in the theft of client data.
Bologna FC: Stolen data including players' medical records, business plans, and financial documents (200GB).
Florida Department of Health: Claimed responsibility for an attack and data leak after the ransom was not paid.
Frontier Communications: A major telecommunications company was targeted.
Halliburton: Experienced widespread disruption in oil and gas operations.
Defenses
Protecting against RansomHub, and ransomware in general, requires a multi-layered approach encompassing proactive security measures, robust detection capabilities, and a well-defined incident response plan. Key defenses include:
Strong Password Policies and Multi-Factor Authentication (MFA): Enforce strong, unique passwords and implement MFA for all critical accounts, particularly those with remote access capabilities (VPN, RDP).
Security Awareness Training: Regularly train employees on phishing and social engineering techniques. Emphasize the dangers of suspicious emails, links, and attachments. Include training on vishing (voice phishing).
Vulnerability Management and Patching: Prioritize patching known vulnerabilities, especially those actively exploited by ransomware groups (as listed in the TTPs section). Maintain a robust vulnerability assessments program.
Endpoint Detection and Response (EDR): Deploy and maintain EDR solutions to detect and respond to malicious activity on endpoints. Configure EDR to detect and block known RansomHub TTPs.
Network Segmentation: Segment networks to limit lateral movement and contain the impact of a potential breach.
Regular Backups and Disaster Recovery: Implement a robust backup and disaster recovery plan, including offline backups to protect against data encryption and deletion. Test backups regularly.
Least Privilege Principle: Restrict user access to only the resources necessary for their job functions. This limits the potential damage from compromised accounts.
Monitor for Suspicious Activity: Implement security logging and monitoring to detect suspicious PowerShell, Python, and command-line activity. Monitor for unusual network traffic, particularly to known malicious IP addresses and domains.
Web Filtering and DNS Security: Implement web filtering and DNS security to block access to malicious websites and domains.
Incident Response Plan: Develop and regularly test an incident response plan that specifically addresses ransomware attacks.
Specific to ESXi Environments:
Secure SSH Access: Disable SSH access to ESXi hosts unless absolutely necessary. If SSH is required, restrict access to specific IP addresses and use strong authentication.
Regularly Patch ESXi Hosts: Keep ESXi hosts up-to-date with the latest security patches.
Monitor for Unusual Activity: Monitor ESXi hosts for unusual activity, such as unauthorized logins, unexpected file transfers, and the execution of unfamiliar scripts. Furthermore, it's crucial to understand indicator of compromise to identify potential threats.
Employ a patch management strategy to stay secure and productive.
Consider a zero trust security model.
Implement security logging and monitoring.
Consider using SOAR for automation.
Conclusion
RansomHub represents a significant and evolving threat in the ransomware landscape. Its rapid growth, strategic affiliate recruitment, and sophisticated TTPs highlight the ongoing challenges faced by organizations. The group's opportunistic targeting, focus on critical infrastructure, and use of double extortion tactics underscore the potential for widespread disruption and financial losses. By understanding RansomHub's origins, tactics, and targets, and implementing robust defensive measures, organizations can significantly reduce their risk of falling victim to this increasingly dangerous threat actor. Continuous vigilance, proactive security practices, and a well-defined incident response plan are crucial for combating the ever-evolving threat of ransomware.
Found this article interesting? Keep visit thesecmaster.com, and our social media page on Facebook, LinkedIn, Twitter, Telegram, Tumblr, Medium, and Instagram and subscribe to receive tips like this.
You may also like these articles:
Arun KL
Arun KL is a cybersecurity professional with 15+ years of experience in IT infrastructure, cloud security, vulnerability management, Penetration Testing, security operations, and incident response. He is adept at designing and implementing robust security solutions to safeguard systems and data. Arun holds multiple industry certifications including CCNA, CCNA Security, RHCE, CEH, and AWS Security.
