Ransomhub

RansomHub, a new threat actor in the cybersecurity landscape, emerged in February 2024 following the takedown of the notorious LockBit group. Many former affiliates of LockBit either opted to work independently using freely available ransomware source code such as Phobos, or aligned themselves with other emerging groups like Akira, BlackSuit, RansomHub, and Medusa. The RansomHub group, in particular, has been identified for its sophisticated tactics, bringing with them the playbooks and toolkits from their previous affiliations. The group has been linked to several significant cyber attacks, most notably against Christie and Patelco Credit Union. Christie disclosed a data breach after falling victim to a RansomHub attack, while Patelco's breach was revealed when RansomHub added the credit union to its Tor leak site in August. These incidents highlight the group's aggressive and damaging approach to cybercrime, causing considerable disruption and potential financial loss to the affected organizations. In terms of technical capabilities, RansomHub has demonstrated advanced tactics that challenge traditional security defenses. The group uses an attack chain that increasingly relies on advanced tools such as EDRKillShifter to bypass security measures. Furthermore, the RansomHub binary can delete all existing Volume Shadow Copy Service (VSS) snapshots on a Windows system without prompting for confirmation, making recovery more difficult. Once executed successfully, the RansomHub ransomware proceeds to encrypt files, appending an extension that depends on the file name of the ransom note. This underlines the group's ability to execute sophisticated and destructive ransomware attacks.