CVE Intelligence
Home / Ransomware Intelligence / All groups / ransomhub

ransomhub Ransomware

🔔 Create alert

Tracked since Feb 10, 2024

0
victims recorded
0
in the last 30 days
0
CVEs
—
Last activity

The group emerged in mid-February 2024 and has already listed several organizations as alleged victims of their attacks, resulting from extortion through encryption and data leaks.

The announcement of the sale of the new Ransomware-as-a-Service (RaaS) by RansomHub was published on one of the Russian-origin forums used by cybercrime to advertise malicious services, known as RAMP4U (or RAMP). A user with the nickname and persona of 'koley' announced the affiliate program on February 2, 2024.

In the new RaaS announcement, it was mentioned that the money laundering operation of the paid ransoms is the responsibility of the affiliate. This means that all communication and sending of the decryptor to the victim are done through chat. The split of this RaaS would be 90% of the value for the affiliate and 10% for the developer, who in this case would be the persona of Koley.

Furthermore, according to the publication, the ransomware payload is written in Golang language, uses the asymmetric algorithm based on x25519, and encryption algorithms AES256, ChaCha20, and xChaCha20, standing out for its speed. The encryption is obfuscated using AST.

The payload would support network propagation and encryption of data both in secure and local mode. According to Koley, the ransomware is designed to operate on platforms such as Windows, Linux, and ESXi, as well as other architectures such as ARM and MIPS.

As pointed out by the panel and already highlighted by the intelligence team, Koley stated that the panel uses a .onion domain, allowing the affiliate to organize and manage targets and chat rooms, view access logs, automatically respond when offline, and create private blog pages.
Source: https://github.com/crocodyli/ThreatActors-TTPs

Vulnerabilities cited for this group

CVEs associated with the group by ransomware.live. Records not yet published here appear without a link.

No CVE associated with this group in the sources.

Tactics and techniques (MITRE ATT&CK)

Initial Access
T1078 Valid AccountsT1078.003 Valid Accounts: Local AccountsT1190 Exploit Public-Facing ApplicationT1566.001 Phishing: Spearphishing AttachmentT1566.004 Phishing: Spearphishing Voice
Execution
T1047 Windows Management InstrumentationT1059 Command and Scripting InterpreterT1059.001 Command and Scripting Interpreter: PowerShellT1059.003 Command and Scripting Interpreter: Windows Command ShellT1059.006 Command and Scripting Interpreter: PythonT1203 Exploitation for Client Execution
Persistence
T1098 Account ManipulationT1133 External Remote ServicesT1136 Create AccountT1136.001 Create Account: Local AccountT1136.002 Create Account: Domain AccountT1547 Boot or Logon Autostart ExecutionT1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup FolderT1547.004 Boot or Logon Autostart Execution: Winlogon Helper DLL
Privilege Escalation
T1068 Exploitation for Privilege EscalationT1548.002 Abuse Elevation Control Mechanism: Bypass UAC
Defense Evasion
T1027 Obfuscated Files or InformationT1027.009 Obfuscated Files or Information: Embedded PayloadsT1027.013 Obfuscated Files or Information: Encrypted/Encoded FileT1036 MasqueradingT1055.012 Process Injection: Process HollowingT1070 Indicator RemovalT1070.001 Indicator Removal: Clear Windows Event LogsT1112 Modify RegistryT1134 Access Token ManipulationT1134.001 Access Token Manipulation: Token Impersonation/TheftT1222.001 File and Directory Permissions Modification: Windows PermissionsT1480 Execution GuardrailsT1484.001 Domain or Tenant Policy Modification: Group Policy ModificationT1562 Impair Defenses: Disable or Modify ToolsT1562.001 Impair Defenses: Disable or Modify ToolsT1564 Hidden ArtifactsT1564.003 Hidden Artifacts: Hidden WindowT1620 Reflective DLL Injection
Credential Access
T1003 OS Credential DumpingT1003.001 OS Credential Dumping: LSASS MemoryT1003.003 OS Credential Dumping: NTDST1003.008 OS Credential Dumping: /etc/passwd and /etc/shadowT1110 Brute ForceT1110.003 Brute Force: Password SprayingT1555.005 Credentials from Password Stores: Password Managers
Discovery
T1007 System Service DiscoveryT1016.001 Internet Connection DiscoveryT1018 Remote System DiscoveryT1033 System Owner/User DiscoveryT1046 Network Service DiscoveryT1057 Process DiscoveryT1082 System Information DiscoveryT1083 File and Directory DiscoveryT1087 Account DiscoveryT1087.001 Account Discovery: Local AccountT1087.002 Account Discovery: Domain AccountT1120 Peripheral Device DiscoveryT1135 Network Share DiscoveryT1482 Domain Trust Discovery
Lateral Movement
T1021 Remote ServicesT1021.001 Remote Services: Remote Desktop ProtocolT1021.002 Remote Services: SMB/Windows Admin SharesT1021.004 Remote Services: SSHT1210 Exploitation of Remote ServicesT1570 Lateral Tool Transfer
Collection
T1005 Data from Local System
Exfiltration
T1048 Exfiltration Over Alternative ProtocolT1048.002 Exfiltration Over Alternative Protocol: Asymmetric Encrypted Non-C2 ProtocolT1048.003 Exfiltration Over Alternative Protocol: Unencrypted Non-C2 ProtocolT1537 Transfer Data to Cloud AccountT1567 Exfiltration Over Web ServiceT1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage
Command and Control
T1071.001 Application Layer Protocol: Web ProtocolsT1102.002 Web Service: Bidirectional CommunicationT1219 Remote Access Tools
Impact
T1486 Data Encrypted for ImpactT1489 Service StopT1490 Inhibit System RecoveryT1529 System Shutdown/RebootT1531 Account Access RemovalT1561.001 Disk Wipe: Disk Content Wipe
Resource Development
T1586 Compromise Accounts

Observed tools

Credential Theft
Mimikatz
Defense Evasion
Acronis Disk Director · BadRentdrv2 · Revo Uninstaller · ThreatFire System Monitor driver (BYOVD)
Discovery Enum
Angry IP Scanner · Nmap · SoftPerfect NetScan · WKTools
Exfiltration
FileZilla · PSCP · RClone · WinSCP
LOLBAS
BITSAdmin · PsExec · WMIC
Networking
Cloudflared · Ngrok · Stowaway
Offsec
Cobalt Strike · CrackMapExec · Impacket · Kerbrute · Metasploit · NetExec · Sliver
RMM-Tools
AnyDesk · Atera · N-Able · ScreenConnect · Splashtop · TightVNC

Victims posted on leak sites, according to ransomware.live. Victim names are not displayed. · View on ransomware.live