Skip to main content
Meet us at Black Hat USA 2026— Las Vegas, August 1–6Book a Meeting
Mallory
Ransomware3 malware families

RansomHub

Also known asRansomHubSpoiled Scorpius

RansomHub is a ransomware-as-a-service (RaaS) group that first appeared in February 2024 and became one of the most prolific ransomware groups to emerge after the 2024 disruption of LockBit and the demise of ALPHV/BlackCat. It is also referred to as Spoiled Scorpius. Reporting in the provided content describes RansomHub as highly active and affiliate-driven, with links or associations noted to other groups including Play, Medusa, and BianLian, and with Scattered Spider described as an affiliate or partner in some reporting. The group has been associated with rapid, goal-oriented intrusion behavior and double-extortion-style ransomware activity in broader incident reporting. A notable distinguishing feature of RansomHub is that its operators developed and maintained a proprietary EDR-killing tool, EDRKillShifter, and offered it directly to affiliates through the affiliate panel. Multiple sources in the content describe this as unusual among RaaS programs, with RansomHub specifically highlighted as having built an in-house EDR killer for affiliate use. The group has also been linked in incident reporting to deployment chains involving Poortry and Stonestop prior to attempted ransomware execution. The content associates RansomHub with several access and tooling ecosystems. It has been observed exploiting Splashtop to gain access to victim systems, maintain persistence, and in some cases facilitate access sales. It has also been identified as a follow-on ransomware consumer of SocGholish/FakeUpdates access. Huntress reporting cited in the content characterizes RansomHub as an actor that often enters environments with a clear plan and moves quickly. The provided reporting also describes ecosystem relationships and later disruption. RansomHub was mentioned in connection with DragonForce, including claims of partnership, takeover activity, and later reporting that DragonForce claimed to take over RansomHub infrastructure. One source states RansomHub went offline in April 2025, and another says the group was taken over by DragonForce and shut down completely; some researchers suggested part of the group migrated to Qilin. The content also notes a claim by a RansomHub member that both RansomHub and DragonForce had FSB contacts, but this is presented as an accusation rather than established fact.

Share:
Are they targeting you?

Know when an actor pivots toward your sector

Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.

MITRE ATT&CK

Tradecraft

51 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.

15 of 15 tactics64 techniques×N= number of intelligence reports citing this technique
MITRE ATT&CK
TA0043
Reconnaissance
1 technique
T1598
Phishing for Information
TA0042
Resource Development
2 techniques
T1587
Develop Capabilities
T1587.001
Malware
T1588
Obtain Capabilities
T1588.002
Tool
TA0001
Initial Access
5 techniques
T1078
Valid Accounts
T1133
External Remote Services
T1189
Drive-by Compromise
T1190×3
Exploit Public-Facing Application
T1566
Phishing
T1566.004
Spearphishing Voice
TA0002
Execution
3 techniques
T1053
Scheduled Task/Job
T1053.005
Scheduled Task
T1059
Command and Scripting Interpreter
T1059.007
JavaScript
T1204×2
User Execution
TA0003
Persistence
5 techniques
T1053
Scheduled Task/Job
T1053.005
Scheduled Task
T1078
Valid Accounts
T1112
Modify Registry
T1133
External Remote Services
T1505
Server Software Component
TA0004
Privilege Escalation
3 techniques
T1053
Scheduled Task/Job
T1053.005
Scheduled Task
T1068×4
Exploitation for Privilege Escalation
T1078
Valid Accounts
TA0005
Stealth
5 techniques
T1027
Obfuscated Files or Information
T1070
Indicator Removal
T1078
Valid Accounts
T1480
Execution Guardrails
T1497
Virtualization/Sandbox Evasion
TA0112
Defense Impairment
1 technique
T1112
Modify Registry
TA0006
Credential Access
5 techniques
T1003
OS Credential Dumping
T1187
Forced Authentication
T1552
Unsecured Credentials
T1555
Credentials from Password Stores
T1555.003
Credentials from Web Browsers
T1649
Steal or Forge Authentication Certificates
TA0007
Discovery
7 techniques
T1033
System Owner/User Discovery
T1057
Process Discovery
T1082
System Information Discovery
T1083
File and Directory Discovery
T1135
Network Share Discovery
T1482
Domain Trust Discovery
T1497
Virtualization/Sandbox Evasion
TA0008
Lateral Movement
1 technique
T1021
Remote Services
T1021.001×2
Remote Desktop Protocol
T1021.002
SMB/Windows Admin Shares
TA0009
Collection
3 techniques
T1005
Data from Local System
T1074
Data Staged
T1213×2
Data from Information Repositories
TA0011
Command and Control
3 techniques
T1090
Proxy
T1090.003
Multi-hop Proxy
T1105×2
Ingress Tool Transfer
T1219
Remote Access Tools
TA0010
Exfiltration
5 techniques
T1020×2
Automated Exfiltration
T1041×3
Exfiltration Over C2 Channel
T1048×2
Exfiltration Over Alternative Protocol
T1537
Transfer Data to Cloud Account
T1567×7
Exfiltration Over Web Service
T1567.002×2
Exfiltration to Cloud Storage
TA0040
Impact
3 techniques
T1485
Data Destruction
T1486×20
Data Encrypted for Impact
T1657×5
Financial Theft
IOCS

Observables

2 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.

IOC values are gated. View more in Mallory for domains, IPs, hashes, and other artifacts, or pipe them straight into your SIEM.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: sector and geo overlap with your footprint, the IOCs they’re burning right now, detection coverage, and what to do next.
Target overlap

Match sector + geo + tech-stack targeting against your real footprint.

Tradecraft mapping51

Every observed MITRE ATT&CK technique, grouped by tactic.

Malware arsenal3

Families this actor is known to deploy, with IOCs and behavior.

Exploited CVEs

CVEs this actor has used in known campaigns.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Observables2

Domains, IPs, and hashes tied to this actor, refreshed continuously.