RansomHub

Profile narrative

RansomHub, also tracked under the alias "Cyberthieves," is a ransomware-as-a-service (RaaS) operation that first emerged in February 2024. The group quickly gained notoriety through its rapid expansion and aggressive targeting of diverse sectors across multiple countries. Security analysts and media reports have characterized RansomHub as prolific, with the group claiming hundreds of victims within months of its founding. Its affiliates reportedly receive 90% of any ransom collected, a revenue model that has attracted operators displaced from other prominent ransomware crews following law enforcement disruptions. Some researchers have suggested the group may be a rebranded variant of the Knight ransomware family.

RansomHub's targeting spans a broad set of sectors and geographies, with confirmed victims in healthcare, government, manufacturing, financial services, and critical infrastructure. Notable incidents include the cyberattack on Planned Parenthood of Montana in August 2024, where the group claimed theft of 93 GB of data and issued extortion threats; the breach of the Florida Department of Health in mid-2024, which disrupted the state's Vital Statistics system used for issuing birth and death certificates; and the compromise of Bjurholms kommun, a Swedish municipality, where 100 GB of data was exfiltrated and internal systems were forced offline. The group also claimed responsibility for an attack on a Spanish bioenergy plant, Matadero de Gijón, targeting its SCADA system using stolen credentials acquired from Russian-language initial access broker forums. Additional confirmed victims include the Brazilian credit cooperative system Sicoob, the Lower Sioux Indian Community's Jackpot Junction Casino Hotel in Minnesota, and American Standard, a major U.S. manufacturer. An earlier incident linked to the group's broader ecosystem involved the Mexican government's presidential legal counsel office, from which 313 GB of data was reportedly stolen in November 2024.

From a tooling and operational perspective, RansomHub's ransomware strains are written in Golang, a relatively newer trend in the ransomware landscape, with some components also utilizing C++. The group employs asymmetric cryptography (x25519) alongside symmetric algorithms including AES-256, ChaCha20, and XChaCha20 to achieve faster encryption speeds. Notably, the group's leak site includes restrictions against targeting organizations in CIS countries, Cuba, North Korea, and China, a pattern some researchers interpret as reflecting pro-Russian leanings, though no definitive state affiliation has been publicly established. Federal agencies including the FBI and CISA have noted that RansomHub has been actively recruiting former affiliates of the LockBit and ALPHV/BlackCat ransomware operations, a development tied to the law enforcement takedowns of those groups. The group's strategic objectives appear consistently financial, focused on double-extortion tactics combining data encryption with the threat of public data leakage to pressure victims into paying ransoms.

RansomHub's operational tempo and willingness to target critical infrastructure, including industrial control systems and government health agencies, have drawn sustained attention from U.S. federal authorities and cybersecurity firms. Despite the group's rapid rise and high-profile victim list, its exact geographic base and internal organizational structure remain unconfirmed in public reporting. The combination of an attractive affiliate revenue split, the absorption of talent from disrupted rival groups, and demonstrated capability against both conventional IT environments and operational technology networks has positioned RansomHub as one of the more prominent ransomware threats observed since early 2024.

Incidents

Attributed incidents are available to members.

Sources

Sources available to members: 9 sources.