RansomHub Leverages SocGholish FakeUpdates to Target Government Sector

Researchers report a large-scale RansomHub ransomware campaign using the SocGholish/FakeUpdates malvertising chain: thousands of compromised (primarily WordPress) sites redirect real users via Keitaro TDS to fake update pages that drop obfuscated JavaScript loaders and Python-based backdoors, enable domain-shadowed C2, data exfiltration and double-extortion; RansomHub operates as a RaaS with high affiliate payouts, exploits known CVEs and brute-force access, and has claimed hundreds of victims across multiple sectors.