Group-IB DFIR and Threat Intelligence teams published a detailed analysis on Group-IB covering RansomHub's origins and a forensically documented incident response case. RansomHub emerged February 2, 2024 on RAMP forum — strategically timed to exploit the void left by simultaneous law enforcement disruption of ALPHV and LockBit. The group acquired and rebranded source code and affiliate panel from the disbanded Knight (formerly Cyclops) ransomware group, subsequently adding unique capabilities including SFTP remote encryption (announced July 18, 2024) and cross-platform support across Windows, Linux, ESXi, FreeBSD, and ARM architectures. As of early 2025, RansomHub had claimed over 600 victims globally including 44 healthcare organizations.
Attack Chain: CVE-2024-3400 Pivot to Brute Force, CVE-2021-42278 sAMAccount Spoofing, and ZeroLogon Domain Takeover
The documented incident began with exploitation attempts against CVE-2024-3400 (Palo Alto Networks PAN-OS command injection with root-level RCE) — a vulnerability previously used only by a China-based nation-state actor with no public PoC available. When the exploit script failed, the affiliate pivoted to brute-forcing the VPN service with an enriched dictionary of over 5,000 username/password combinations, gaining initial access through a default credential from a data backup solution. Internal reconnaissance used Angry IP Scanner, Nmap, and PowerShell scripts to identify the domain controller. Domain compromise used two vulnerabilities in sequence: CVE-2021-42278 (sAMAccount spoofing — creating a computer account, renaming it to match a DC name without trailing "$", requesting a TGT, then renaming it again and using S4U2self to obtain a domain controller service ticket) and CVE-2020-1472 (ZeroLogon — NTLM-based MS-NRPC exploitation enabling credential-free domain controller takeover). Full domain control was achieved and lateral movement proceeded using any domain account.
Exfiltration via FileZilla and EDR Termination via PCHunter Before locker.exe Deployment
After lateral movement, the affiliate uploaded FileZilla to NAS and critical file servers, using it to exfiltrate data to external C2 servers — with configuration files recovered by DFIR revealing C2 IPs, usernames, destination ports, and service configurations. The affiliate then disabled the victim's backup service before uploading PCHunter (a kernel-level security tool capable of terminating EDR processes) and using it to disable all endpoint security solutions across compromised hosts. The ransomware binary (locker.exe) was then deployed and required a passphrase at runtime to decrypt the embedded config file — enabling encryption parameters, victim-specific extension (.6706c3), and a README_<random>.txt ransom note per directory. The ransomware stopped VMs via base64-encoded PowerShell, deleted shadow copies, cleared Security/System/Application event logs, and encrypted 1 MB per 3 MB file interval by default (configurable to 1 MB per 9 MB with -fast flag). Total attack duration: under 14 hours.
Multi-Platform Ransomware: Windows Safe Mode, SMB Share Targeting, and CLI-Controlled Execution
RansomHub's Windows variant supports extensive CLI control: -safeboot for Safe Mode encryption, -disable-net to disable network interfaces pre-encryption, -host for targeting specific SMB shares, -only-local for local-disk-only encryption, -sleep for delayed execution, -cmd for pre-encryption command execution, -skip-vm for selective VM exclusion, and -pass for passphrase-gated config decryption. Separate variants target ESXi, Linux, FreeBSD, and ARM environments. The ransomware uses a Master Public Key to protect per-file encryption keys, appends unique per-victim extensions, and drops per-directory ransom notes. Ransom notes contain no initial payment demand — victims are directed to contact the group, which assigns each victim a unique @gmx.de or @web.de email address.