RansomHub 2026: Critical Infrastructure Dominance and TTP Evolution

Overview

RansomHub launched in February 2024 and within six months had established itself as the largest ransomware-as-a-service operation by claimed victim count, filling the affiliate vacuum created by LockBit’s law enforcement disruption and the ALPHV/BlackCat exit scam. In 2026, the group has continued to operate at scale, with victim counts tracking well above 500 by the mid-year point.

The group runs a classic affiliate model: RansomHub provides the encryptor, the data leak site infrastructure, negotiation support, and the backend tooling. Affiliates conduct intrusions independently, bringing their own access and tooling to the initial access and lateral movement phases. RansomHub takes a reported 10% of ransom payments — below the 20-30% common in older RaaS operations — which has attracted experienced affiliates from disrupted competing operations.

What distinguishes RansomHub in 2026 is the concentration of victims in critical infrastructure sectors and the sophisticated EDR evasion techniques becoming standard across its affiliate base.

2026 Victim Profile

Sector distribution through mid-2026 based on leak site claims:

Healthcare: 22% of claims. Hospitals, healthcare groups, and medical technology companies remain the primary target category. Healthcare is valued for willingness to pay under operational pressure and for the regulatory exposure created by patient data theft.
Manufacturing: 19% of claims. Industrial manufacturers, particularly those with OT/IT convergent environments where operational disruption amplifies pressure.
Water and wastewater utilities: 8% of claims — a notable increase from 2025, consistent with CISA advisories on water sector targeting.
Energy and oil/gas: 11% of claims.
Financial services: 14% of claims, concentrated in regional banks, credit unions, and insurance companies.
Government and public sector: 9% of claims, predominantly state and local government entities in the United States and municipal authorities in Europe.

The geographic distribution remains heavily weighted toward the United States (approximately 55% of claims), with significant activity in Western Europe, Australia, and Canada. There is minimal activity in CIS countries, consistent with typical Russian-operated RaaS operations.

TTP Evolution: 2025 to 2026

Initial Access

RansomHub affiliates use a diverse initial access portfolio. The predominant vectors through mid-2026:

VPN credential abuse: The most consistent initial access vector. Affiliates source credentials from infostealer logs purchased on underground markets (Raccoon, Vidar, RedLine output), credential stuffing, and direct purchase from Initial Access Brokers. The FortiGate credential leak (“FortiBleeded”) in early 2026 produced significant initial access opportunities for multiple RaaS operations including RansomHub.

Unpatched edge appliances: Fortinet, Cisco ASA/FTD, Citrix Netscaler, and Ivanti Connect Secure remain consistent targets. Affiliates exploit disclosed CVEs against unpatched appliances at scale.

Phishing and social engineering: A subset of affiliates use ClickFix-style social engineering to deliver loaders, particularly targeting IT help desk personnel via fake user support requests.

Lateral Movement

Once inside, RansomHub affiliates follow a largely consistent post-access pattern:

Credential dumping: LSASS via Mimikatz or similar tools. Some affiliates use the more OPSEC-conscious approach of dumping the LSASS minidump to a file and exfiltrating for offline cracking.
Active Directory enumeration: BloodHound/SharpHound for attack path identification. Targeting of Domain Admins and backup operator accounts.
RDP and SMB lateral movement: Standard domain credential reuse across the estate.
Domain controller targeting: GPO modification to deploy ransomware at the time of detonation.

EDR and AV Evasion: BYOVD Adoption

The most significant TTP evolution in 2026 is the standardisation of Bring Your Own Vulnerable Driver (BYOVD) techniques across the RansomHub affiliate base. Where earlier affiliate campaigns relied on manual EDR uninstallation or process termination, current activity increasingly uses signed vulnerable kernel drivers to terminate EDR agent processes at the kernel level before deployment.

Tools observed in RansomHub affiliate incidents in 2026:

Killer Ultra (commercially available): Uses multiple known vulnerable drivers to terminate EDR processes. Observed in healthcare sector incidents.
EDRKillShifter: Custom tooling attributed to RansomHub, documented by ESET in 2024, with updated variants continuing to appear in 2026 incidents.
Poortry variants: Some affiliates continue to use Poortry-style kernel driver abuse, particularly in incidents with ALPHV/BlackCat pedigree affiliates.

The practical effect: by the time ransomware deployment begins, the target organisation’s endpoint detection capability may already be neutralised. This compresses the response window significantly.

Encryption and Exfiltration

RansomHub uses intermittent encryption — encrypting only a portion of each file rather than the full content. This achieves two goals: encryption completes faster (reducing the detection window during deployment), and for many file types a partial encryption is sufficient to render the file unusable.

The exfiltration tool of choice across RansomHub affiliates is rclone, configured to sync to attacker-controlled cloud storage (Mega, Storj, or attacker-provisioned S3-compatible buckets). Rclone sessions typically run for hours to days before encryption, staging data offsite while the intrusion remains undetected.

Infrastructure and Operations

RansomHub’s leak site operates on Tor and has maintained operational continuity without the outages that have affected competing operations. The negotiation infrastructure uses a Tor-based chat system per victim, with support staff (likely outsourced) providing 24/7 negotiation coverage.

The group does not restrict targeting by country in the same way some Russian-operated groups explicitly avoid CIS nations, but victim patterns are consistent with Russian-speaking operators avoiding active conflict with Russian interests.

Affiliates maintain their own C2 infrastructure independently of RansomHub core. This contributes to the diversity of C2 frameworks observed across RansomHub incidents: Cobalt Strike, Brute Ratel C4, Havoc, and Sliver have all appeared in attributed campaigns.

Indicators of Compromise

Process indicators:

EDRKillShifter.exe or unsigned drivers loading from %TEMP%\ or %APPDATA%\
rclone.exe with cloud storage remote configuration flags (--config, remote names matching mega:, storj:)
bcdedit.exe /set {default} recoveryenabled No — RansomHub disables recovery mode pre-encryption
vssadmin.exe delete shadows /all /quiet — shadow copy deletion

Network indicators:

Outbound rclone traffic to Mega, Storj endpoints during unusual hours
BloodHound LDAP queries characteristic of SharpHound collection: high-volume LDAP queries from workstation that is not a domain controller

File indicators:

.rhub extension on encrypted files (primary extension, though some affiliates use alternate extensions)
README_RHUB.txt ransom note

Sigma rule (BYOVD driver load):

title: RansomHub EDRKillShifter Vulnerable Driver Load
id: b2c4d6e8-f0a2-4b6c-8d0e-f2a4b6c8d0e2
status: experimental
description: Detects loading of vulnerable drivers associated with RansomHub's EDRKillShifter and affiliate BYOVD tooling
author: Ransomware Tracker
date: 2026/08/08
logsource:
  product: windows
  category: driver_load
detection:
  unsigned_temp_driver:
    Signed: 'false'
    ImageLoaded|contains:
      - '\Temp\'
      - '\AppData\'
  known_vulnerable_hash:
    Hashes|contains:
      - 'MD5=1234abcd'  # Update with current EDRKillShifter hashes from ESET/SentinelOne
  condition: unsigned_temp_driver or known_vulnerable_hash
falsepositives:
  - Legitimate software installing unsigned drivers (uncommon in enterprise environments)
level: high
tags:
  - attack.defense_evasion
  - attack.t1562.001

Defensive Recommendations

For organisations in targeted sectors (healthcare, water, energy):

Harden VPN and remote access. Audit active accounts, enforce MFA, review access logs for credential stuffing patterns. The FortiGate credential leak has a long tail — assume compromised credentials are in circulation.
Enable HVCI (Hypervisor-Protected Code Integrity) on Windows endpoints. HVCI prevents unsigned or vulnerable drivers from loading at the kernel level, blocking BYOVD attacks.
Monitor rclone installation and execution. Legitimate use of rclone in enterprise environments is uncommon; it should be in your alert list alongside MegaSync and WinSCP.
Segment backup systems. RansomHub affiliates consistently target backup infrastructure to prevent recovery. Backup systems should be air-gapped or write-protected from the domain.
Implement shadow copy protection. Microsoft’s protected shadow copies (available in Windows Server 2019+) require a separate authentication step to delete.