RansomHub extortion gang linked to now-defunct Knight ransomware

RansomHub is a prolific ransomware-as-a-service believed to have been derived from the recently defunct Knight ransomware after its source code surfaced; analysts found multiple technical overlaps (both written in Go, Gobfuscate obfuscation, unique string encoding, identical command help, and safe-mode reboot behavior). Since emerging in early 2024, RansomHub has focused on data theft and extortion — publishing stolen files (linked to Change Healthcare) and threatening/leaking data from victims such as Christie’s — indicating active, large-scale criminal operations likely run by actors who acquired Knight’s code and attracted former affiliates of other RaaS groups.