RansomHub

RansomHub affiliates gained access through phishing emails, exploiting vulnerabilities, and password spraying. Common vulnerabilities exploited include CVE-2023-3519 (Citrix ADC), CVE-2023-27997 (Fortinet), and CVE-2020-1472 (Netlogon privilege escalation).

Once inside, affiliates escalated privileges using tools like Mimikatz, enabling full control over compromised systems.

They disabled security tools, clear logs, and renamed ransomware executables to blend into system files, evading detection.

Using credential dumping tools and password spraying, affiliates gathered administrative credentials to access high-value systems.

Network reconnaissance was conducted using tools like Nmap and PowerShell to identify valuable targets and plan further exploitation.

Affiliates moved laterally using tools like Remote Desktop Protocol (RDP), PsExec, and AnyDesk, gaining access to additional systems within the network.

Sensitive data was exfiltrated using tools like Rclone and WinSCP, often for double extortion purposes, where the stolen data was used as leverage in ransom negotiations.

The ransomware was executed across the victim’s network, encrypting files using Curve 25519 elliptic-curve encryption.

Data was exfiltrated through encrypted protocols, cloud accounts, or direct transfers to attacker-controlled servers.

RansomHub’s encryption rendered victim systems inoperable, often leading to extensive operational downtime. Affiliates deleted backups and volume shadow copies to prevent recovery efforts, maximizing the pressure on victims to pay the ransom.