What’s RansomHub?
Regardless of first showing earlier this yr, RansomHub is already thought of one of the vital prolific ransomware teams in existence.
It operates a ransomware-as-a-service (RaaS) operation, that means {that a} central core of the group creates and maintains the ransomware code and infrastructure, and rents it out to different cybercriminals who act as associates.
How has RansomHub change into such an enormous deal so shortly?
RansomHub undoubtedly benefited from the disruption caused to the LockBit gang by regulation enforcement in February 2024. A world operation towards LockBit not solely noticed the seizure of among the group’s web sites and decryption instruments, but in addition trolled associates that they had been being watched.
Many associates who had beforehand used encryptors from the LockBit group have switched to rival RaaS gangs. Amongst these has been RansomHub, which Test Level studies was accountable for “a big rise” in assaults in June, with nearly 80 new victims.
So, making life tougher for LockBit did not eliminate the ransomware downside…
…it simply drove it elsewhere, sure.
However RansomHub has additionally actively recruited associates from different ransomware-as-a-service operations. For example, it took beneath its wing former ALPHV/BlackCat associates after that group scammed its partners.
So I am guessing that RansomHub works the identical as different ransomware?
Just about. Attackers break into your organisation, exfiltrate delicate knowledge, after which encrypt your techniques. In the future you come into the workplace and you discover an digital ransom word demanding that you just pay a ransom word for each a decryption instrument to get better your garbled recordsdata, and to cease the gang publishing the recordsdata on the darkish internet.
Researchers believe that RansomHub’s origins could be traced again to an older ransomware referred to as Knight. Knight’s supply code was supplied on the market on hacking boards in February 2024 – and so they have quite a few similarities.
You are suggesting that ransomware teams are lazy…
Aren’t all programmers? If another person has already written code that does the job proficiently, there’s usually little sense in reinventing the wheel. Knight itself was based mostly upon an earlier ransomware referred to as Cyclops.
Do we all know the place the RansomHub gang relies?
As with all these teams, it is tough to be definitive. Nonetheless, there are some clues in statements the group has made on-line.
On its web site, in its “About” part, RansomHub says that it doesn’t permit assaults on “CIS, Cuba, North Korea, and China.” Subsequently, it would not be terribly shocking if we found that the RansomHub group was predominantly based mostly in a rustic that was pleasant to Russia or, certainly, Russia itself.
Effectively, there is a shock. Why would they wish to stop assaults towards their very own nation and its allies?
As a result of cybercriminals will discover life much more traumatic if their native regulation enforcement officers are ready to show a blind eye if solely companies in enemy nations are being hacked.
So, who has RansomHub claimed to have attacked?
Most lately, it stated it had been behind an assault towards the Florida Division of Well being, claiming it had published 100 GB worth of data stolen from the organisation after failing to safe a ransom cost. Different high-profile assaults linked to RansomHub embrace one on the Christie’s auction house.
Certainly one of RansomHub’s most notable victims,, nonetheless, was Change Healthcare.
Grasp on, I assumed Change Healthcare was hit by the ALPHV/BlackCat group?
Effectively remembered. ALPHV/BlackCat did launch a ransomware assault on Change Healthcare in February this yr, severely disrupting the flexibility of pharmacies to satisfy orders from sufferers who wished to pay for his or her medical prescriptions by means of their insurance coverage.
However Change Healthcare’s complications did not finish there. In April, RansomHub additionally started posting delicate medical and monetary info apparently taken from the well being expertise supplier, and threatening to publish it until ransoms had been paid by insurance coverage firms.
These guys appear critical about doing every little thing they’ll to make money…
No person needs to be shocked. In its on-line manifesto, RansomHub says:
Our staff members are from completely different international locations and we aren’t all for anything, we’re solely all for {dollars}.
So, what motion ought to my firm take to guard towards RansomHub?
An important factor to do is to make sure that you have got hardened defences in place earlier than a ransomware assault takes place, limiting any potential influence on your small business.
As well as, it will be clever to observe our recommendations on how to protect your organisation from other ransomware.
Ideas embrace:
- Making safe offsite backups.
- Operating up-to-date safety options and guaranteeing that your computer systems are protected with the most recent safety patches towards vulnerabilities.
- Prohibit an attacker’s potential to unfold laterally by means of your organisation through community segmentation.
- Utilizing hard-to-crack distinctive passwords to guard delicate knowledge and accounts, in addition to enabling multi-factor authentication.
- Encrypting delicate knowledge wherever attainable.
- Decreasing the assault floor by disabling performance that your organization doesn’t want.
- Educating and informing employees in regards to the dangers and strategies utilized by cybercriminals to launch assaults and steal knowledge.
Keep secure, and do not permit your organisation to be the subsequent sufferer to fall sufferer to RansomHub.
Editor’s Notice: The opinions expressed on this visitor writer article are solely these of the contributor and don’t essentially replicate these of Tripwire.
