Ransomware.live: ransomhub

The group emerged in mid-February 2024 and has already listed several organizations as alleged victims of their attacks, resulting from extortion through encryption and data leaks.

The announcement of the sale of the new Ransomware-as-a-Service (RaaS) by RansomHub was published on one of the Russian-origin forums used by cybercrime to advertise malicious services, known as RAMP4U (or RAMP). A user with the nickname and persona of 'koley' announced the affiliate program on February 2, 2024.

In the new RaaS announcement, it was mentioned that the money laundering operation of the paid ransoms is the responsibility of the affiliate. This means that all communication and sending of the decryptor to the victim are done through chat. The split of this RaaS would be 90% of the value for the affiliate and 10% for the developer, who in this case would be the persona of Koley.

Furthermore, according to the publication, the ransomware payload is written in Golang language, uses the asymmetric algorithm based on x25519, and encryption algorithms AES256, ChaCha20, and xChaCha20, standing out for its speed. The encryption is obfuscated using AST.

The payload would support network propagation and encryption of data both in secure and local mode. According to Koley, the ransomware is designed to operate on platforms such as Windows, Linux, and ESXi, as well as other architectures such as ARM and MIPS.

As pointed out by the panel and already highlighted by the intelligence team, Koley stated that the panel uses a .onion domain, allowing the affiliate to organize and manage targets and chat rooms, view access logs, automatically respond when offline, and create private blog pages.
Source: https://github.com/crocodyli/ThreatActors-TTPs

Victims

842

First Discovered

2024-02-10

victim

Last Discovered

2025-03-31

victim

Inactive Since

1yr

more than

Avg Delay

19.0

days

Infostealer

26.2%

victims with domain

Countries

hit

View Victims on World Map View Group Statistics

Known Locations (3)

Title	Available	Last Visit	FQDN
RansomHub \| Home	No	2026-04-28T07:26:01	`ransomxifxwc5eteopdobynonjctkxxvap77yqifu2emfbecgbqdw6qd.onion`
Index of /	No	2026-04-28T07:28:34	`ransomgxjnwmu5ceqwo2jrjssxpoicolmgismfpnslaixg3pgpe5qcad.onion`
Index of /	No	2026-04-28T07:31:06	`fpwwt67hm3mkt6hdavkfyqi42oo3vkaggvjj4kxdr2ivsbzyka5yr2qd.onion`

Target

Heatmap

Ransom Notes (4)

Tools Used

This information is provided by Ransomware-Tool-Matrix
Discovery	RMM Tools	Defense Evasion	Credential Theft	OffSec	Networking	LOLBAS	Exfiltration
Angry IP Scanner Nmap SoftPerfect NetScan WKTools placeholder placeholder placeholder	AnyDesk Atera N-Able ScreenConnect Splashtop TightVNC placeholder	Acronis Disk Director BadRentdrv2 Revo Uninstaller ThreatFire System Monitor driver (BYOVD) placeholder placeholder placeholder	Mimikatz placeholder placeholder placeholder placeholder placeholder placeholder	Cobalt Strike CrackMapExec Impacket Kerbrute Metasploit NetExec Sliver	Cloudflared Ngrok Stowaway placeholder placeholder placeholder placeholder	BITSAdmin PsExec WMIC placeholder placeholder placeholder placeholder	FileZilla PSCP RClone WinSCP placeholder placeholder placeholder

Vulnerabilities Exploited (9)

This information is provided by Ransomware-Vulnerability-Matrix
Vendor	Product	CVE	Source
Apache	ActiveMQ	CVE-2023-46604	cisa.gov
Atlassian	Confluence Data Center & Server	CVE-2023-22515	cisa.gov
Citrix	NetScaler ADC & Gateway	CVE-2023-3519	cisa.gov
Fortinet	FortiOS SSL-VPN & FortiProxy	CVE-2023-27997	cisa.gov
Fortinet	FortiClientEMS	CVE-2023-48788	cisa.gov
F5	BIG-IP	CVE-2023-46747	cisa.gov
Windows	NetLogon	CVE-2020-1472	cisa.gov
Windows	BITS	CVE-2020-0787	cisa.gov
Windows	SMBv1	CVE-2017-0144	cisa.gov

TTPs Matrix (13)

This information is provided by Crocodyli & Ransomware.live
Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Impact	Resource Development
Valid Accounts	Windows Management Instrumentation	Account Manipulation	Exploitation for Privilege Escalation	Obfuscated Files or Information	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	Exfiltration Over Alternative Protocol	Application Layer Protocol: Web Protocols	Data Encrypted for Impact	Compromise Accounts
Valid Accounts: Local Accounts	Command and Scripting Interpreter	External Remote Services	Abuse Elevation Control Mechanism: Bypass UAC	Obfuscated Files or Information: Embedded Payloads	OS Credential Dumping: LSASS Memory	Internet Connection Discovery	Remote Services: Remote Desktop Protocol		Exfiltration Over Alternative Protocol: Asymmetric Encrypted Non-C2 Protocol	Web Service: Bidirectional Communication	Service Stop
Exploit Public-Facing Application	Command and Scripting Interpreter: PowerShell	Create Account		Obfuscated Files or Information: Encrypted/Encoded File	OS Credential Dumping: NTDS	Remote System Discovery	Remote Services: SMB/Windows Admin Shares		Exfiltration Over Alternative Protocol: Unencrypted Non-C2 Protocol	Remote Access Tools	Inhibit System Recovery
Phishing: Spearphishing Attachment	Command and Scripting Interpreter: Windows Command Shell	Create Account: Local Account		Masquerading	OS Credential Dumping: /etc/passwd and /etc/shadow	System Owner/User Discovery	Remote Services: SSH		Transfer Data to Cloud Account		System Shutdown/Reboot
Phishing: Spearphishing Voice	Command and Scripting Interpreter: Python	Create Account: Domain Account		Process Injection: Process Hollowing	Brute Force	Network Service Discovery	Exploitation of Remote Services		Exfiltration Over Web Service		Account Access Removal
	Exploitation for Client Execution	Boot or Logon Autostart Execution		Indicator Removal	Brute Force: Password Spraying	Process Discovery	Lateral Tool Transfer		Exfiltration Over Web Service: Exfiltration to Cloud Storage		Disk Wipe: Disk Content Wipe
		Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder		Indicator Removal: Clear Windows Event Logs	Credentials from Password Stores: Password Managers	System Information Discovery
		Boot or Logon Autostart Execution: Winlogon Helper DLL		Modify Registry		File and Directory Discovery
				Access Token Manipulation		Account Discovery
				Access Token Manipulation: Token Impersonation/Theft		Account Discovery: Local Account
				File and Directory Permissions Modification: Windows Permissions		Account Discovery: Domain Account
				Execution Guardrails		Peripheral Device Discovery
				Domain or Tenant Policy Modification: Group Policy Modification		Network Share Discovery
				Impair Defenses: Disable or Modify Tools		Domain Trust Discovery
				Impair Defenses: Disable or Modify Tools
				Hidden Artifacts
				Hidden Artifacts: Hidden Window
				Reflective DLL Injection

Negotiation Chats (1)

Ransomhub