Signalis
sign in--:--:--UTC
Threat actors

RansomHub

☆ pin
Reports
9
First seen
Oct 8, 2024
Last seen
Jun 19, 2026
Motivation
Financial

Targeting

Sectors
Other ×2

Top ATT&CK techniques

T1486 Data Encrypted for Impact ×6T1562.001 Impair Defenses: Disable or Modify Tools ×5T1566 Phishing ×4T1021 Remote Services ×4T1021.001 Remote Services: Remote Desktop Protocol ×3T1078 Valid Accounts ×3T1110 Brute Force ×3T1133 External Remote Services ×2T1070.001 Indicator Removal: Clear Windows Event Logs ×2T1219 Remote Access Software ×2T1567 Exfiltration Over Web Service ×2T1027 Obfuscated Files or Information ×2

Indicators

filename ×103hash_md5 ×15hash_sha256 ×15hash_sha1 ×15ip_v4 ×11domain ×5url ×2registry_key ×1cve ×1

Indicator values are available on Pro and via the API.

Associated CVEs

CVE-2024-1709 (exploited)CVE-2024-40766 (exploited)CVE-2024-47575 (exploited)CVE-2024-50383 (exploited)

Recent reports

High

Operation Endgame Disrupts SocGholish Servers, Cleans 14,971 WordPress Sites

The Hacker NewsHigh

State of ransomware in 2026: post-quantum cryptography, encryptionless extortion, and industrialized access brokers

Kaspersky SecurelistHigh

Ransomware as an industry: understanding the franchise operation behind modern extortion attacks

ESET WeLiveSecurityHigh

EDR Killers Explained: Beyond the Drivers — ESET's Analysis of 90 Active Tools

ESET WeLiveSecurityCritical

Ransomware Affiliate Campaign Links Play, RansomHub, and DragonForce Groups

The DFIR ReportCritical

Password Spray Leads to RansomHub Ransomware Deployment

The DFIR ReportHigh

Time to Ransom is Money: Analyzing Ransomware Deployment Timelines

Huntress BlogInfo

2025 Cybersecurity Threat Report – Huntress

Huntress BlogHigh

Top 3 Cybersecurity Threats of 2024: RMM Abuse, BYOVD Attacks, and WebDAV Abuse

Huntress Blog

This page shows data on a 7-day delay. Free accounts get the full delayed feed; real-time reports, indicators, and the API start at $29/mo.

Sign upSee plans