Since its discovery in February 2024, RansomHub has quickly become a dominant force in ransomware. As of now, according to global statistics, this group of Masked Actors has already surpassed even long-established cybercriminals in attacks.
Primary target sectors are industrial manufacturing and healthcare. Over 200 organizations have been infiltrated (August 2024), with 74 victims reported in September alone. Notable victims include laptop maker Clevo.
After launching its affiliate program in February 2024, RansomHub recruited former Scattered Spider group members (ex-Conti and REvil), offering Ransomware-as-a-Service (RaaS), enabling even low-skilled cybercriminals to launch sophisticated attacks. RansomHub presents itself as a group of helpful and professional consultants rather than cybercriminals, offering “valuable advice” on IT protection, post-payment.
