MITRE ATT&CKsoftware (malware)
S1212 RansomHub
- Domain
- enterprise
- Platforms
- Linux, Windows
- Version
- 1.0
- Created
- 2025-03-17
Description
RansomHub is a ransomware-as-a-service (RaaS) offering with Windows, ESXi, Linux, and FreeBSD versions that has been in use since at least 2024 to target organizations in multiple sectors globally. RansomHub operators may have purchased and rebranded resources from Knight (formerly Cyclops) Ransomware which shares infrastructure, feature, and code overlaps with RansomHub.
Related
Uses · MITRE ATT&CK (21)
- T1685.005 Clear Windows Event Logs sub-technique
- T1688 Safe Mode Boot technique
- T1027.013 Encrypted/Encoded File sub-technique
- T1059.001 PowerShell sub-technique
- T1059.003 Windows Command Shell sub-technique
- T1497.003 Time Based Checks sub-technique
- T1491.001 Internal Defacement sub-technique
- T1021.002 SMB/Windows Admin Shares sub-technique
- T1070.004 File Deletion sub-technique
- T1547.001 Registry Run Keys / Startup Folder sub-technique
- T1490 Inhibit System Recovery technique
- T1489 Service Stop technique
- T1486 Data Encrypted for Impact technique
- T1480 Execution Guardrails technique
- T1135 Network Share Discovery technique
- T1140 Deobfuscate/Decode Files or Information technique
- T1018 Remote System Discovery technique
- T1057 Process Discovery technique
- T1082 System Information Discovery technique
- T1083 File and Directory Discovery technique
- T1090 Proxy technique
References
- https://www.group-ib.com/blog/ransomhub-never-sleeps-episode-1/ Group-IB RansomHub FEB 2025
- https://www.cisa.gov/sites/default/files/2024-09/aa24-242a-stopransomware-ransomhub-ransomware_1.pdf CISA RansomHub AUG 2024