Summary
This technical report provides a comprehensive threat profile of Ransomhub ransomware, which operates as a ransomware-as-a-service (RaaS) model. First identified in February 2024, Ransomhub affiliates reportedly receive 90% of ransom payments, while the core group retains a 10% commission. The report outlines the operational style, including the extortion method of double extortion, where both data encryption and sensitive data exfiltration are employed. It details the most frequently targeted industries, primarily in the industrial sector, and highlights the geographical distribution of previous victim headquarters, with a significant focus on North America. Additionally, the report discusses known exploited vulnerabilities, associations with other ransomware groups, and the tools utilized by Ransomhub affiliates. The document emphasizes the operational methods and initial access strategies employed by affiliates, including social engineering tactics. Overall, this report serves as a detailed resource for understanding the Ransomhub ransomware threat landscape.
