Overview
RansomHub launched its Ransomware-as-a-Service operation in February 2024 on RAMP, the Russian-language cybercrime forum. Within six months it had become one of the highest-volume ransomware operations, attracting former affiliates from LockBit and ALPHV/BlackCat following those groups’ respective law enforcement disruptions. After LockBit’s operation was significantly degraded in February 2025 and ALPHV performed an exit scam against its affiliates in March 2024, RansomHub positioned itself as the destination for displaced, capable ransomware affiliates.
By mid-2025, multiple threat intelligence vendors ranked RansomHub as the most active ransomware group by confirmed victim count. By 2026 it has claimed over 600 victims across 45 countries and shows no signs of reduced operational tempo.
Affiliate Model
RansomHub operates an affiliate-first RaaS model with terms designed to attract high-volume attackers away from competitors:
- 90/10 revenue split: Affiliates keep 90% of each ransom payment; RansomHub retains 10%. This is the most favourable split in the current RaaS market — the industry norm from LockBit and ALPHV was 80/20 or 75/25.
- Direct victim payment: Victims pay affiliates directly, not through RansomHub infrastructure. This reduces the group’s exposure to law enforcement seizure of cryptocurrency wallets and removes RansomHub as an escrow risk after the ALPHV exit-scam precedent.
- No attack restrictions except: affiliates cannot target CIS countries, Cuba, North Korea, or China. The Commonwealth of Independent States exclusion is standard for Russian-language ransomware operations.
- No healthcare restrictions in practice: Despite claimed restrictions on hospitals, multiple healthcare victims have appeared on the RansomHub leak site including Change Healthcare (the largest healthcare data breach in US history), multiple hospital systems, and pharmaceutical companies.
The affiliate programme has attracted significant recruitment from former ALPHV and LockBit affiliates. ALPHV affiliates were left unpaid after the exit scam; LockBit affiliates faced increased law enforcement attention after the February 2025 Cronos operation. RansomHub offered both groups a credible alternative with better financial terms.
Technical Tooling
Encryptor characteristics:
RansomHub’s encryptor is written in Go, with variants targeting Windows x64, Linux/ESXi, and FreeBSD. The Go implementation provides cross-platform compilation without platform-specific toolchains and compiles to a single binary with no external runtime dependencies. The encryptor uses Curve25519 for asymmetric key exchange and ChaCha20 for symmetric encryption, with XSalsa20 for file content encryption in some variants.
The encryptor implements an intermittent encryption mode — encrypting only portions of files above a threshold size — to increase encryption speed on large file sets.
EDR evasion:
CISA advisory AA24-242A (August 2024) noted that RansomHub affiliates had begun deploying the Kasseika EDR-killing driver (a renamed, modified version of the Martini AV-killer driver) to disable endpoint protection before deploying the encryptor. The technique: the driver is loaded using bring-your-own-vulnerable-driver (BYOVD) technique, exploiting signed-but-vulnerable legitimate drivers to gain kernel access, then terminates endpoint protection processes.
Affiliates also routinely use legitimate remote management tools (AnyDesk, Atera, Splashtop) for persistence and lateral movement to avoid triggering AV detections on custom tooling.
Exfiltration:
Data exfiltration typically uses MEGASync, rclone, or WinSCP for bulk transfer to cloud storage before encryption. ExByte, a custom exfiltration tool, has been observed in some intrusions for more targeted data collection.
Victim Profile and Statistics
RansomHub maintains a Tor-hosted leak site (“RansomHub Leak”) listing non-paying victims and stolen data for download. Analysis of leak site data and confirmed victim reports:
Sector distribution (2024-2026):
- Healthcare: 17% (highest of any sector)
- Critical infrastructure: 14%
- Finance and banking: 12%
- Manufacturing: 11%
- Government and public sector: 10%
- Professional services and legal: 9%
- Energy and utilities: 8%
- Other: 19%
Notable confirmed victims:
- Change Healthcare (US) — 100+ million patients’ data compromised; $22 million reportedly paid to ALPHV before RansomHub claimed the data separately
- Christie’s Auction House — data on approximately 500,000 high-net-worth clients
- Patelco Credit Union — 726,000 members affected
- Rite Aid — 2.2 million customers
- Philadelphia Inquirer, Ann & Robert H. Lurie Children’s Hospital, numerous water utility operators
Geographic distribution: United States (52%), United Kingdom (9%), Germany (7%), Canada (5%), Australia (4%), Other EU (12%), Rest of world (11%).
TTPs and Attack Chain
RansomHub affiliates do not use a single fixed intrusion method — affiliates select their own initial access approach. Common patterns documented in incident response reports:
Initial access:
- Exploitation of unpatched edge devices (Fortinet, Citrix, Check Point, Cisco VPN vulnerabilities) — the most common observed initial access vector
- Phishing campaigns delivering credential stealers
- Purchased access via initial access brokers (IABs)
- Exploitation of exposed RDP or VNC services
Post-compromise:
- Credential harvesting using Mimikatz, Secretsdump
- Active Directory reconnaissance with BloodHound/SharpHound
- Lateral movement via PSExec, SMB, or legitimate RMM tools
- Data exfiltration using MEGASync or rclone (typically 48-96 hours before encryption)
- EDR/AV termination using Kasseika or similar BYOVD
- Encryptor deployment via domain group policy or PsExec
Mean dwell time before encryption: 3-7 days based on IR firm reports.
MITRE ATT&CK Coverage
| Stage | Technique | Tool |
|---|---|---|
| Initial Access | T1190 (Exploit Public-Facing Application) | Fortinet/Citrix exploits |
| Credential Access | T1003.001 (LSASS Memory) | Mimikatz |
| Discovery | T1087.002 (Domain Account Discovery) | BloodHound |
| Lateral Movement | T1021.002 (SMB/Windows Admin Shares) | PsExec |
| Exfiltration | T1567.002 (Exfiltration to Cloud Storage) | MEGASync, rclone |
| Impact | T1486 (Data Encrypted for Impact) | RansomHub encryptor |
| Defence Evasion | T1068 (Exploitation for Privilege Escalation) | BYOVD/Kasseika |
Negotiation and Payment
RansomHub sets ransom demands based on victim revenue, typically targeting 2-5% of annual revenue for enterprise victims. Payment deadline is typically 72-90 hours before data is published. Extensions are negotiated. The group has shown willingness to negotiate and has accepted significant discounts from initial demands.
Cryptocurrency payment is exclusively in Monero (XMR), which unlike Bitcoin provides transaction privacy. This is operationally significant: Bitcoin ransom payments are increasingly traceable and have led to asset seizures; Monero payments are substantially harder to trace and seize.
Defensive Priorities
Given RansomHub’s predominant use of unpatched edge device exploitation as initial access:
- Maintain emergency patching cadence for all internet-facing VPN, firewall, and remote access appliances. The gap between CVE publication and RansomHub exploitation is measured in days.
- Audit Active Directory for accounts with excessive privileges; remove all unnecessary direct admin rights.
- Monitor for BYOVD indicators: driver loading events for known-vulnerable drivers (RTCore64.sys and variants) via Windows Event ID 6 or Sysmon Event ID 6.
- Implement network segmentation that prevents lateral movement between user, server, and OT/infrastructure zones even after initial access.
- Test offsite backups regularly; confirm they are isolated from domain credentials and cannot be reached by a domain-compromised attacker.