RansomHub
- ID
- S1212
- Type
- Malware
- Platforms
- Linux, Windows
- Source
- attack.mitre.org
- MITRE last modified
- 27 Mar 2025
RansomHub is a ransomware-as-a-service (RaaS) offering with Windows, ESXi, Linux, and FreeBSD versions that has been in use since at least 2024 to target organizations in multiple sectors globally. RansomHub operators may have purchased and rebranded resources from Knight (formerly Cyclops) Ransomware which shares infrastructure, feature, and code overlaps with RansomHub.[1][2]
Techniques used (21)
- T1018 Remote System Discovery
- T1021.002 SMB/Windows Admin Shares
- T1027.013 Encrypted/Encoded File
- T1057 Process Discovery
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1070.004 File Deletion
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1090 Proxy
- T1135 Network Share Discovery
- T1140 Deobfuscate/Decode Files or Information
- T1480 Execution Guardrails
- T1486 Data Encrypted for Impact
- T1489 Service Stop
- T1490 Inhibit System Recovery
- T1491.001 Internal Defacement
- T1497.003 Time Based Checks
- T1547.001 Registry Run Keys / Startup Folder
- T1685.005 Clear Windows Event Logs
- T1688 Safe Mode Boot