RansomHub Actors Exploit ZeroLogon Vuln in Recent Ransomware Attacks

RansomHub is an emerging ransomware-as-a-service that has rapidly victimized dozens of organizations by exploiting the ZeroLogon (CVE-2020-1472) flaw and leveraging remote-access tools (Atera, Splashtop) and network scanners; its payload shows extensive code overlap with the older Knight ransomware, and the group is actively recruiting affiliates and expanding operations.