RansomHub
Ransomware-as-a-Service (RaaS) — Russian-speaking core team (assessed) · Financial — ransomware and extortion
Tactics, Techniques & Procedures (TTPs)
- Dominant post-disruption RaaS — absorbed hundreds of ALPHV and LockBit affiliates in early 2024
- 90/10 affiliate revenue split — most aggressive commission structure in the major RaaS market
- Multi-platform encryptor: Windows, Linux, VMware ESXi, and FreeBSD from a single Go codebase
- ChaCha20 per-file encryption with RSA-4096 key encapsulation; intermittent encryption for large files
- Affiliate-specific initial access — VPN appliance exploitation, phishing, IAB credentials, Zerologon (CVE-2020-1472)
- ESXi management interface targeting for multiplier effect: one host compromise encrypts entire virtual server estate
- Data exfiltration via Rclone before encryption; backup infrastructure specifically targeted and destroyed
- Affiliate-driven RaaS model (affiliates keep ~90% of ransom)
- Initial access via phishing, RDP brute force, VPN vulnerabilities
- ALPHV/BlackCat refugee affiliates post-disruption
- LockBit affiliates post-law enforcement action
- Double-extortion with dedicated leak site
- EDR evasion and disabling of security tools
Known Targets
Analyst Notes
RansomHub launched February 2024 immediately after the FBI's Operation Cronos disrupted LockBit and the ALPHV/BlackCat core team exit-scammed affiliates out of a $22 million Change Healthcare ransom payment. Within months, RansomHub became the most prolific ransomware group globally by victim count, claiming 2,000+ victims across 80+ countries by end of 2024. The 90/10 affiliate split was explicitly designed to attract the most capable displaced affiliates. CISA issued joint advisory AA24-242A in August 2024 documenting affiliate TTPs. The non-CIS targeting policy and Russia-adjacent operational behaviour indicate a core team operating from jurisdictions with limited extradition exposure. No law enforcement disruption as of mid-2026. Additional reporting: RansomHub emerged in early 2024 and rapidly absorbed affiliates displaced by law enforcement action against ALPHV/BlackCat and LockBit. Now one of the most active RaaS platforms by victim count.
Also Known As
Intelligence Reports
RansomHub: The RaaS Platform That Inherited the Ransomware Ecosystem
RansomHub launched in February 2024 as a direct beneficiary of two simultaneous law enforcement disruptions — the FBI's LockBit takedown and the ALPHV/BlackCat collapse — and in less than a year became the most prolific ransomware group by victim count. This deep dive covers how RansomHub built its dominance, the multi-platform technical architecture, the affiliate model that makes it resilient to law enforcement pressure, and what defenders should prioritise.
RansomHub Affiliates Targeting UK Law Firms During Active M&A Mandates
Multiple UK and European law firms have been hit by RansomHub-affiliated actors during live M&A transactions. The timing is deliberate: attackers maximise leverage by striking when client pressure to resolve the incident is highest.
NHS Trusts Targeted in Coordinated Ransomware Wave as RaaS Affiliates Shift Focus
A cluster of ransomware affiliates, several previously linked to ALPHV/BlackCat, has targeted three NHS trusts in the past six weeks. Attackers are exploiting legacy VPN appliances and unpatched remote access infrastructure.