Ransomhub

The group emerged in mid-February 2024 and has already listed several organizations as alleged victims of their attacks, resulting from extortion through encryption and data leaks.

The announcement of the sale of the new Ransomware-as-a-Service (RaaS) by RansomHub was published on one of the Russian-origin forums used by cybercrime to advertise malicious services, known as RAMP4U (or RAMP). A user with the nickname and persona of 'koley' announced the affiliate program on February 2, 2024.

In the new RaaS announcement, it was mentioned that the money laundering operation of the paid ransoms is the responsibility of the affiliate. This means that all communication and sending of the decryptor to the victim are done through chat. The split of this RaaS would be 90% of the value for the affiliate and 10% for the developer, who in this case would be the persona of Koley.

Furthermore, according to the publication, the ransomware payload is written in Golang language, uses the asymmetric algorithm based on x25519, and encryption algorithms AES256, ChaCha20, and xChaCha20, standing out for its speed. The encryption is obfuscated using AST.

The payload would support network propagation and encryption of data both in secure and local mode. According to Koley, the ransomware is designed to operate on platforms such as Windows, Linux, and ESXi, as well as other architectures such as ARM and MIPS.

As pointed out by the panel and already highlighted by the intelligence team, Koley stated that the panel uses a .onion domain, allowing the affiliate to organize and manage targets and chat rooms, view access logs, automatically respond when offline, and create private blog pages.
Source: https://github.com/crocodyli/ThreatActors-TTPs

Victims

844

First Discovered

2024-02-10

victim

Last Discovered

2025-03-31

victim

Inactive Since

358

days

Avg Delay

18.9

days

Infostealer

15.8%

victims with domain

View Victims on World Map

View group statistics

Known Locations (3)

Title	Available	Last Visit	FQDN
RansomHub \| Home	No	2025-06-01 21:19:12	`ransomxifxwc5eteopdobynonjctkxxvap77yqifu2emfbecgbqdw6qd.onion`
Index of /	No	2025-06-01 21:19:32	`ransomgxjnwmu5ceqwo2jrjssxpoicolmgismfpnslaixg3pgpe5qcad.onion`
Index of /	No	2025-06-01 21:19:38	`fpwwt67hm3mkt6hdavkfyqi42oo3vkaggvjj4kxdr2ivsbzyka5yr2qd.onion`

Target (Available)

Heatmap (Available)

Ransom Notes (4)

Tools Used (Available)

This information is provided by Ransomware-Tool-Matrix
Discovery	RMM Tools	Defense Evasion	Credential Theft	OffSec	Networking	LOLBAS	Exfiltration
Angry IP Scanner Nmap SoftPerfect NetScan WKTools placeholder placeholder	AnyDesk Atera N-Able ScreenConnect Splashtop TightVNC	BadRentdrv2 ThreatFire System Monitor driver (BYOVD) placeholder placeholder placeholder placeholder	Mimikatz placeholder placeholder placeholder placeholder placeholder	Cobalt Strike CrackMapExec Impacket Kerbrute Metasploit Sliver	Stowaway placeholder placeholder placeholder placeholder placeholder	BITSAdmin PsExec placeholder placeholder placeholder placeholder	PSCP RClone WinSCP placeholder placeholder placeholder

Vulnerabilities Exploited (9)

This information is provided by Ransomware-Vulnerability-Matrix
Vendor	Product	CVE	Source
Apache	ActiveMQ	CVE-2023-46604	cisa.gov
Atlassian	Confluence Data Center & Server	CVE-2023-22515	cisa.gov
Citrix	NetScaler ADC & Gateway	CVE-2023-3519	cisa.gov
Fortinet	FortiOS SSL-VPN & FortiProxy	CVE-2023-27997	cisa.gov
Fortinet	FortiClientEMS	CVE-2023-48788	cisa.gov
F5	BIG-IP	CVE-2023-46747	cisa.gov
Windows	NetLogon	CVE-2020-1472	cisa.gov
Windows	BITS	CVE-2020-0787	cisa.gov
Windows	SMBv1	CVE-2017-0144	cisa.gov

TTPs Matrix (4)

This information is provided by Crocodyli & Ransomware.live
Execution	Defense Evasion	Lateral Movement	Impact
Windows Management Instrumentation	Indicator Removal: Clear Windows Event Logs	Lateral Tool Transfer	Data Encrypted for Impact
Command and Scripting Interpreter: Windows Command Shell	Impair Defenses: Disable or Modify Tools		Service Stop
			Inhibit System Recovery

Negotiation Chats (1)

YARA Rules (0)