RansomHub Targets Patchable Bugs in Microsoft Active Directory and Netlogon

RansomHub, an active RaaS platform emerging in 2024, leverages unpatched vulnerabilities (e.g., ZeroLogon, noPac), brute-force attacks, and default/backup accounts to gain domain-level access; they perform credential theft, lateral movement, EDR disablement, data exfiltration, and encryption using modern crypto (Curve25519/ChaCha20/AES) while operating a lucrative affiliate model and conducting double-extortion against high-value targets.