Group-IB RansomHub FEB 2025

RansomHub can enumerate all accessible machines from the infected system.

RansomHub can use credentials provided in its configuration to move laterally from the infected machine over SMBv2.

RansomHub has an encrypted configuration file.

RansomHub can use PowerShell to delete volume shadow copies.

RansomHub can use `cmd.exe` to execute multiple commands on infected hosts.

RansomHub has the ability to self-delete.

RansomHub can retrieve information about virtual machines.

RansomHub has the ability to only encrypt specific files.

RansomHub can use a proxy to connect to remote SFTP servers.

RansomHub has the ability to target specific network shares for encryption.

RansomHub can use a provided passphrase to decrypt its configuration file.

RansomHub will terminate without proceeding to encryption if the infected machine is on a list of allowlisted machines specified in its configuration.

RansomHub can use Elliptic Curve Encryption to encrypt files on targeted systems. RansomHub can also skip content at regular intervals (ex. encrypt 1 MB, skip 3 MB) to optomize performance and enable faster encryption for large files.

RansomHub has the ability to terminate specified services.

RansomHub has used `vssadmin.exe` to delete volume shadow copies.

RansomHub can sleep for a set number of minutes before beginning execution.

RansomHub has created an autorun Registry key through the `-safeboot-instance -pass` command line argument.

RansomHub can delete events from the Security, System, and Application logs.

RansomHub can reboot targeted systems into Safe Mode prior to encryption.