Rebranded Knight Ransomware Targeting Healthcare and Businesses Worldwide

RansomHub is an updated, rebranded variant of Knight/Cyclops ransomware operating as a Ransomware-as-a-Service across Windows, Linux, macOS, ESXi, and Android; it leverages phishing, known exploits (e.g., ZeroLogon), Gobfuscate obfuscation, legitimate remote-admin tools (Atera, Splashtop), and double-extortion tactics, has been linked to multiple high-profile victims and 26 confirmed attacks in April 2024, and is actively recruiting affiliates following other ransomware shutdowns.