RansomHub Ransomware Decryption & Data Recovery

RansomHub launched in February 2024; the CISA advisory identifies Cyclops and Knight as its predecessors (Trend Micro tracks the operators as Water Bakunawa). Its timing was telling: LockBit had just been disrupted by international law enforcement and ALPHV/BlackCat was preparing its exit scam, leaving many experienced affiliates in need of a platform. RansomHub absorbed them quickly with unusually affiliate-favourable economics — widely reported at a 90% share — and a model where affiliates collect first and remit afterwards. Among them was the affiliate behind the February 2024 Change Healthcare breach whose ransom ALPHV had pocketed; he brought a copy of the data to RansomHub and re-extorted the same victim.

Growth was rapid. By the time CISA published advisory AA24-242A in August 2024, at least 210 victim organisations had been recorded across healthcare, government, water systems, financial services and critical manufacturing; cumulative leak-site claims exceeded 800. Through the second half of 2024, RansomHub was among the most prolific groups worldwide by published victims.

The ending was just as fast. Around 31 March 2025 its negotiation portal and leak site began going offline, with full disruption by 1 April. DragonForce promptly claimed on the RAMP forum that RansomHub had "joined our cartel" and took over or defaced its site. Group-IB and others observed a large affiliate migration into Qilin — one of the direct reasons Qilin's volume doubled from Q2 2025 and it went on to lead global rankings. RansomHub has not resumed operations and should be treated as dormant.

Two practical implications. First, where data encrypted by RansomHub remains unresolved, there is no counterparty left to pay for keys — only technical recovery. Second, and more important: the people who attacked you are still operating. RansomHub affiliates carried the same playbook to Qilin, DragonForce and others, and its core path — known Citrix, Fortinet and Confluence flaws, VPN without MFA, password spraying, destroy backups then hit virtualisation — remains exactly what regional enterprises most need to close.

Extension. Encrypted files gain a random six-character uppercase alphanumeric suffix, differing per victim or per deployment. Extension alone cannot establish the family; it must be cross-checked against the note name.

Ransom note. The filename takes the form README_[the same six-character string].txt, dropped in every encrypted directory. That correspondence between extension and note filename is the most reliable RansomHub identifier — mechanically similar to BlackCat's seven-character scheme but with a different length.

Note content. No email address is provided, only a .onion client portal link and a victim-specific client ID. The publication deadline is typically between 3 and 90 days, set by the affiliate.

Host-side artefacts.

• Volume shadow copies deleted (vssadmin / wmic).
• Traces of EDRKillShifter-class BYOVD tooling — loading a vulnerable signed driver to terminate EDR — a signature tool of RansomHub affiliates.
• PsExec, AnyDesk, Atera and Splashtop-style remote and bulk-execution tools.
• Large volumes of failed logons left by password spraying and brute force.

Platform footprint. Encryptor payloads were generated per platform from the operator panel, with Windows, Linux/NAS, ESXi and SFTP builds — so a single incident can hit Windows hosts, Linux servers, ESXi guests and NAS devices simultaneously.

Timeline note. RansomHub went dormant in early April 2025. RansomHub-like events after that date need fresh family identification, and usually reflect migrated affiliates operating under Qilin, DragonForce or another platform.

RansomHub's affiliate base was heterogeneous — many arrived from ALPHV and LockBit — so tradecraft varied, but the main lines in the CISA advisory are clear.

1. Mass exploitation of known vulnerabilities, including:

• CVE-2023-3519 (Citrix ADC/Gateway remote code execution)
• CVE-2023-27997 and CVE-2020-12812 (Fortinet FortiOS)
• CVE-2023-46604 (Apache ActiveMQ)
• CVE-2023-22515 (Atlassian Confluence)
• plus classics such as Zerologon and EternalBlue for internal escalation and lateral movement.

2. Password spraying and credential attacks against webmail, VPN and RDP gateways, using accounts sourced from breach dumps — essentially free where MFA is absent.

3. Phishing for initial payload delivery or credential theft.

4. Initial access brokers, buying established network access outright.

The typical post-compromise chain:

• terminate EDR with BYOVD tooling such as EDRKillShifter to clear the field;
• harvest credentials with Mimikatz-class tools and escalate to domain admin;
• enumerate and destroy backups first (backup servers, backup storage, cloud sync), then delete shadow copies;
• exfiltrate with Rclone or cloud-storage clients;
• generate per-platform encryptors from the operator panel and deploy them simultaneously across Windows, Linux, ESXi and NAS via PsExec, scheduled tasks or remote tools.

Worth stressing: although the RansomHub brand is dormant, its affiliates took this entire path with them to Qilin, DragonForce and elsewhere. Auditing against this list defends against attacks that are still live today.

Algorithms. Key agreement via Curve25519, with file content encrypted using AES or ChaCha20 depending on platform. Compared with traditional RSA constructions, Curve25519 uses shorter keys and faster operations — part of why RansomHub encrypted so quickly. Key material can only be recovered with the operators' private key, and no exploitable weakness is public.

Intermittent encryption. The CISA advisory records intermittent encryption explicitly: files are processed in chunks with sections skipped, covering the most hosts in the least time. For large files — VMDKs, database data files, archives — that means a meaningful proportion of original data was never overwritten, which is the main opening for recovery. The skip ratio varies with build parameters and must be measured per case.

Multi-platform builds. Encryptors were generated on demand from the operator panel in Windows, Linux/NAS, ESXi and SFTP variants with differing command-line options and features. The practical consequence is that a single incident often encrypted the Windows domain, Linux application servers, ESXi guests and NAS shares almost simultaneously, so recovery must address several technology stacks at once.

Destructive actions.

• Deletes volume shadow copies (vssadmin / wmic).
• Locates and destroys backup servers and backup storage as a priority.
• Terminates EDR through BYOVD tooling such as EDRKillShifter.
• Stops database and backup-agent services.

Double extortion and deadlines. Exfiltration preceded encryption, with a publication deadline set by the affiliate, typically 3 to 90 days, after which data appeared on the .onion leak site. Note that both the leak site and the negotiation portal have been unavailable since April 2025.