RansomHub
RansomHub is a ransomware group with a financial motive, tracked by Brandefense. It targets 18 sectors, including Government and Technology, in 85 countries, including the United States and the United Kingdom. It uses 111 MITRE ATT&CK techniques and exploits 30 known CVEs.
- RansomHub Team
- RansomHub Ransomware
- Water Bakunawa
- Techniques
- 111
- Exploited CVEs
- 30
- First seen
- Feb 1, 2024
- Last seen
- Jan 31, 2025
- Record updated
Who They Target.
About RansomHub.
The group emerged in mid-February 2024 and has already listed several organizations as alleged victims of their attacks, resulting from extortion through encryption and data leaks. The announcement of the sale of the new Ransomware-as-a-Service (RaaS) by RansomHub was published on one of the Russian-origin forums used by cybercrime to advertise malicious services, known as RAMP4U (or RAMP). A user with the nickname and persona of 'koley' announced the affiliate program on February 2, 2024. In the new RaaS announcement, it was mentioned that the money laundering operation of the paid ransoms is the responsibility of the affiliate. This means that all communication and sending of the decryptor to the victim are done through chat. The split of this RaaS would be 90% of the value for the affiliate and 10% for the developer, who in this case would be the persona of Koley. Furthermore, according to the publication, the ransomware payload is written in Golang language, uses the asymmetric algorithm based on x25519, and encryption algorithms AES256, ChaCha20, and xChaCha20, standing out for its speed. The encryption is obfuscated using AST.
Last updated Oct 1, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.