How a CPU spike led to uncovering a RansomHub ransomware attack

**Executive summary:** A targeted compromise attributed to RansomHub affiliates began with a malicious JavaScript masquerading as a browser update, which deployed packed Python-based malware (SocGhoulish) that established a SOCKS proxy, harvested credentials (including DPAPI abuses), leveraged misconfigured AD CS to escalate to Domain Admin, and exfiltrated large volumes of data via AzCopy; Varonis detected the activity (CPU spike), worked with the customer to contain and remediate, and prevented a subsequent ransomware deployment with zero business downtime.