RansomHub

RansomHub was a financially motivated ransomware-as-a-service operation active by 2024 and widely tracked as a major criminal extortion group until its apparent shutdown in April 2025. It is also associated with the alias Spoiled Scorpius. The operation used an affiliate model in which partners conducted intrusions and extortion while the core service maintained leak-site infrastructure and, unusually for a ransomware crew, supplied affiliates with offensive tooling including endpoint-security disabling capabilities. RansomHub conducted double extortion, combining data theft with ransomware deployment and public leak-site pressure. The group publicly listed victims, threatened to sell stolen data, and was linked to repeat extortion of organizations previously compromised by other ransomware actors, including cases suggesting affiliate migration from ALPHV/BlackCat into the RansomHub ecosystem. Reporting also indicates overlap between RansomHub victim postings and previously exposed datasets in some cases, showing that at least some extortion activity may have relied on already accessible data rather than exclusively on fresh intrusions. The group’s tradecraft included post-compromise privilege escalation, persistence, credential theft, lateral movement, and defense evasion. RansomHub intrusions have been associated with use of PsExec and NirSoft credential-harvesting utilities, as well as Mimikatz-style credential access patterns seen across the broader ransomware ecosystem. On Linux, campaigns were documented using CVE-2024-1086 for post-compromise privilege escalation and persistence via new systemd services. RansomHub affiliates were also observed deploying PoorTry, also known as BurntCigar, to disable and even wipe critical endpoint detection and response components before encryption. In addition, RansomHub developed and distributed EDRKillShifter to affiliates, reflecting a comparatively centralized approach to anti-EDR tooling. Betruger has also been reported as commonly deployed by RansomHub affiliates. Victimology was broad and opportunistic, with confirmed targeting across healthcare and healthcare-adjacent organizations, government entities, business services, and other enterprise environments. Public reporting ties the group to attacks or extortion affecting organizations in North America, Europe, Latin America, and elsewhere, with the United States appearing prominently in victim reporting. RansomHub was part of the broader post-LockBit and post-ALPHV ransomware reshuffling of 2024-2025, and its decline or retirement was followed by affiliate movement to other operations including Qilin and DragonForce.