Threat intelligence / Malware

RansomHub

[RansomHub](https://attack.mitre.org/software/S1212) is a ransomware-as-a-service (RaaS) offering with Windows, ESXi, Linux, and FreeBSD versions that has been in use since at least 2024 to target organizations in multiple sectors globally. [RansomHub](https://attack.mitre.org/software/S1212) operators may have purchased and rebranded resources from Knight (formerly Cyclops) Ransomware which shares infrastructure, feature, and code overlaps with [RansomHub](https://attack.mitre.org/software/S1212).(Citation: CISA RansomHub AUG 2024)(Citation: Group-IB RansomHub FEB 2025)

Malware

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[RansomHub](https://attack.mitre.org/software/S1212) is a ransomware-as-a-service (RaaS) offering with Windows, ESXi, Linux, and FreeBSD versions that has been in use since at least 2024 to target organizations in multiple sectors globally. [RansomHub](https://attack.mitre.org/software/S1212) operators may have purchased and rebranded resources from Knight (formerly Cyclops) Ransomware which shares infrastructure, feature, and code overlaps with [RansomHub](https://attack.mitre.org/software/S1212).(Citation: CISA RansomHub AUG 2024)(Citation: Group-IB RansomHub FEB 2025)

Labels

malware

21 recorded

Relationships

uses

to Clear Windows Event Logs

Technique

uses

to Data Encrypted for Impact

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to Encrypted/Encoded File

Technique

uses

to Execution Guardrails

Technique

uses

to File and Directory Discovery

Technique

uses

to File Deletion

Technique

uses

to Inhibit System Recovery

Technique

uses

to Internal Defacement

Technique

uses

to Network Share Discovery

Technique

uses

Technique

uses

to Process Discovery

Technique

uses

Technique

uses

to Registry Run Keys / Startup Folder

Technique

uses

to Remote System Discovery

Technique

uses

to Safe Mode Boot

Technique

uses

to Service Stop

Technique

uses

to SMB/Windows Admin Shares

Technique

uses

to System Information Discovery

Technique

uses

to Time Based Checks

Technique

uses

to Windows Command Shell

Technique

3 external

References

mitre-attack

S1212

Group-IB RansomHub FEB 2025

https://www.group-ib.com/blog/ransomhub-never-sleeps-episode-1/

CISA RansomHub AUG 2024

https://www.cisa.gov/sites/default/files/2024-09/aa24-242a-stopransomware-ransomhub-ransomware_1.pdf