RansomHub Resurgence: How a Rebranded Ransomware Gang is Reviving Cybercrime Chaos

RansomHub, likely a rebrand of the Knight ransomware gang, has been auctioning off Christie’s stolen data. Emerging in February, RansomHub has become the fourth most active ransomware crew, often exploiting the ZeroLogon vulnerability. Despite law enforcement efforts, the cyber-crime ecosystem remains a game of whack-a-mole.

Hot Take:

RansomHub: When a cybercrime gang rebrands as if it’s launching a new flavor of ice cream. Seriously, if cyber-criminals put as much effort into legitimate businesses as they do in reinventing themselves, they’d probably be on the cover of Forbes by now.

Key Points:

  • RansomHub is likely a rebrand of the Knight ransomware gang.
  • They’ve targeted high-profile entities like Christie’s, Frontier Communications, and Change Healthcare.
  • Ranked fourth most prolific ransomware crew with 61 attacks in three months.
  • Frequently exploits the ZeroLogon vulnerability for initial access.
  • Shares significant code overlap with Knight, suggesting a rebranding rather than a new operation.

Membership Required

 You must be a member to access this content.

View Membership Levels
Already a member? Log in here