RansomHub ransomware-as-a-service

This Group-IB research describes the emergence of RansomHub, a Ransomware-as-a-Service affiliate program launched Feb 2024 that conducts double-extortion attacks across Windows, Linux, and ESXi, self-propagates within networks, exfiltrates large datasets (often >150 GB) to Mega, recruits affiliates (including former Scattered Spider members), leverages purchased domain/RDP accounts for initial access, and employs common dual-use lateral movement tools; the report maps their TTPs to MITRE ATT&CK, provides IOCs and ransom note/file-extension patterns, and offers defensive recommendations.