RANSOMWARE FAMILY
RansomHub
RansomHub emerged as one of the most active ransomware-as-a-service operations after law enforcement action disrupted several older groups, absorbing affiliates displaced from those takedowns. It has targeted a wide range of sectors, including healthcare and critical infrastructure.
What to look for
- Encrypted files given a varying extension depending on the affiliate deployment
- A ransom note referencing RansomHub, often directing victims to a Tor-based negotiation site
- Double extortion — data theft combined with encryption and a leak-site threat
- Attacks frequently reaching healthcare, critical infrastructure and mid-sized enterprises
Recovery approach
As with most current RaaS operations, the affiliate carrying out the attack can vary the toolkit — our triage identifies the specific variant before we recommend a recovery path.
OTHER FAMILIES WE SEE
Also covered
Play
Also known as PlayCrypt, a group that frequently exploits exposed VPN and remote-access systems.
What to look for →Medusa
A ransomware-as-a-service group operating a public leak site, frequently targeting healthcare and education.
What to look for →Ryuk
An older but historically significant family, often deployed as the final stage of a wider malware infection.
What to look for →LockBit
One of the most widespread ransomware-as-a-service operations, active against organisations worldwide.
What to look for →