Ransomhub

How Ransomhub typically operates, as attributed by MITRE ATT&CK v19.2. Attributed via RansomHub.

1. T1059.001 PowerShell Execution

   What they do: RansomHub can use PowerShell to delete volume shadow copies.

   What that means: Adversaries may abuse PowerShell commands and scripts for execution.

2. T1059.003 Windows Command Shell Execution

   What they do: RansomHub can use `cmd.exe` to execute multiple commands on infected hosts.

   What that means: Adversaries may abuse the Windows command shell for execution.

3. T1547.001 Registry Run Keys / Startup Folder PersistencePrivilege Escalation

   What they do: RansomHub has created an autorun Registry key through the `-safeboot-instance -pass` command line argument.

   What that means: Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key.

4. T1027.013 Encrypted/Encoded File Stealth

   What they do: RansomHub has an encrypted configuration file.

   What that means: Adversaries may encrypt or encode files to obfuscate strings, bytes, and other specific patterns to impede detection.

5. T1070.004 File Deletion Stealth

   What they do: RansomHub has the ability to self-delete.

   What that means: Adversaries may delete files left behind by the actions of their intrusion activity.

6. T1140 Deobfuscate/Decode Files or Information Stealth

   What they do: RansomHub can use a provided passphrase to decrypt its configuration file.

   What that means: Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis.

7. T1480 Execution Guardrails Stealth

   What they do: RansomHub will terminate without proceeding to encryption if the infected machine is on a list of allowlisted machines specified in its configuration.

   What that means: Adversaries may use execution guardrails to constrain execution or actions based on adversary supplied and environment specific conditions that are expected to be present on the target.

8. T1497.003 Time Based Checks StealthDiscovery

   What they do: RansomHub can sleep for a set number of minutes before beginning execution.

   What that means: Adversaries may employ various time-based methods to detect virtualization and analysis environments, particularly those that attempt to manipulate time mechanisms to simulate longer elapses of time.

9. T1685.005 Clear Windows Event Logs Defense Impairment

   What they do: RansomHub can delete events from the Security, System, and Application logs.

   What that means: Adversaries may clear Windows Event Logs to hide the activity of an intrusion.

10. T1688 Safe Mode Boot Defense Impairment

    What they do: RansomHub can reboot targeted systems into Safe Mode prior to encryption.

    What that means: Adversaries may abuse Windows safe mode to disable endpoint defenses.

11. T1018 Remote System Discovery Discovery

    What they do: RansomHub can enumerate all accessible machines from the infected system.

    What that means: Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system.

12. T1057 Process Discovery Discovery

    What they do: RansomHub can stop processes associated with files currently in use to maximize the impact of encryption.

    What that means: Adversaries may attempt to get information about running processes on a system.

13. T1082 System Information Discovery Discovery

    What they do: RansomHub can retrieve information about virtual machines.

    What that means: An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture.

14. T1083 File and Directory Discovery Discovery

    What they do: RansomHub has the ability to only encrypt specific files.

    What that means: Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.

15. T1135 Network Share Discovery Discovery

    What they do: RansomHub has the ability to target specific network shares for encryption.

    What that means: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.

16. T1021.002 SMB/Windows Admin Shares Lateral Movement

    What they do: RansomHub can use credentials provided in its configuration to move laterally from the infected machine over SMBv2.

    What that means: Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).

17. T1090 Proxy Command and Control

    What they do: RansomHub can use a proxy to connect to remote SFTP servers.

    What that means: Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure.

18. T1486 Data Encrypted for Impact Impact

    What they do: RansomHub can use Elliptic Curve Encryption to encrypt files on targeted systems.

    What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.

19. T1489 Service Stop Impact

    What they do: RansomHub has the ability to terminate specified services.

    What that means: Adversaries may stop or disable services on a system to render those services unavailable to legitimate users.

20. T1490 Inhibit System Recovery Impact

    What they do: RansomHub has used `vssadmin.exe` to delete volume shadow copies.

    What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.

21. T1491.001 Internal Defacement Impact

    What they do: RansomHub has placed a ransom note on comrpomised systems to warn victims and provide directions for how to retrieve data.

    What that means: An adversary may deface systems internal to an organization in an attempt to intimidate or mislead users, thus discrediting the integrity of the systems.

Software Ransomhub has been seen using, grouped by what it is used for. Legitimate administration tools appear here because these actors routinely abuse them — presence in this list is not itself malicious.

Tool data from Ransomware Tool Matrix by BushidoUK, licensed CC BY 4.0. Grouped by purpose and matched to this group by Breach House.

The note this group leaves on a compromised machine. Click a filename to read it.

We are the RansomHub.

Your company Servers are locked and Data has been taken to our servers. This is serious. 

Good news:
- your server system and data will be restored by our Decryption Tool;
- for now, your data is secured and safely stored on our server;
- nobody in the world is aware about the data leak from your company except you and RansomHub team;

FAQs:
Who we are?
- Normal Browser Links: https://ransomxifxwc5eteopdobynonjctkxxvap77yqifu2emfbecgbqdw6qd.onion.ly/
- Tor Browser Links: http://ransomxifxwc5eteopdobynonjctkxxvap77yqifu2emfbecgbqdw6qd.onion/

Want to go to authorities for protection?
- Seeking their help will only make the situation worse,They will try to prevent you from negotiating with us, because the negotiations will make them look incompetent,After the incident report is handed over to the government department, you will be fined <This will be a huge amount,Read more about the GDRP legislation:https://en.wikipedia.org/wiki/General_Data_Protection_Regulation>,The government uses your fine to reward them.And you will not get anything, and except you and your company, the rest of the people will forget what happened!!!!!

Think you can handle it without us by decrypting your servers and data using some IT Solution from third-party "specialists"?
- they will only make significant damage to all of your data; every encrypted file will be corrupted forever. Only our Decryption Tool will make decryption guaranteed;  

Don't go to recovery companies, they are essentially just middlemen who will make money off you and cheat you. 
- We are well aware of cases where recovery companies tell you that the ransom price is xxx dollars, but in fact they secretly negotiate with us for xxx dollars, so they earn xxx dollars from you. If you approached us directly without intermediaries you would pay 5 times less, that is xxx dollars.

Think your partner IT Recovery Company will do files restoration? 
- no they will not do restoration, only take 3-4 weeks for nothing; besides all of your data is on our servers and we can publish it at any time; 
  as well as send the info about the data breach from your company servers to your key partners and clients, competitors, media and youtubers, etc. 
  Those actions from our side towards your company will have irreversible negative consequences for your business reputation.

You don't care in any case, because you just don't want to pay? 
- We will make you business stop forever by using all of our experience to make your partners, clients, employees and whoever cooperates with your company change their minds by having no choice but to stay away from your company. 
  As a result, in midterm you will have to close your business. 


So lets get straight to the point.

What do we offer in exchange on your payment:
- decryption and restoration of all your systems and data within 24 hours with guarantee;
- never inform anyone about the data breach out from your company;
- after data decryption and system restoration, we will delete all of your data from our servers forever;
- provide valuable advising on your company IT protection so no one can attack your again.

Now, in order to start negotiations, you need to do the following: 
- install and run 'Tor Browser' from https://www.torproject.org/download/
- use 'Tor Browser' open http://dd4djzr2ywfcox3zfvpkpyh3b657hsdwpwv5cfkmdfde2lr3fpz6spad.onion/
- enter your Client ID: 

There will be no bad news for your company after successful negotiations for both sides. But there will be plenty of those bad news if case of failed negotiations, so don't think about how to avoid it.
Just focus on negotiations, payment and decryption to make all of your problems solved by our specialists within 1 day after payment received: servers and data restored, everything will work good as new.

************************************************

We are the RansomHub.

Your company Servers are locked and Data has been taken to our servers. This is serious. 

Good news:
- your server system and data will be restored by our Decryption Tool;
- for now, your data is secured and safely stored on our server;
- nobody in the world is aware about the data leak from your company except you and RansomHub team;

FAQs:
Who we are?
- Normal Browser Links: https://ransomxifxwc5eteopdobynonjctkxxvap77yqifu2emfbecgbqdw6qd.onion.ly/
- Tor Browser Links: http://ransomxifxwc5eteopdobynonjctkxxvap77yqifu2emfbecgbqdw6qd.onion/

Want to go to authorities for protection?
- Seeking their help will only make the situation worse,They will try to prevent you from negotiating with us, because the negotiations will make them look incompetent,After the incident report is handed over to the government department, you will be fined <This will be a huge amount,Read more about the GDRP legislation:https://en.wikipedia.org/wiki/General_Data_Protection_Regulation>,The government uses your fine to reward them.And you will not get anything, and except you and your company, the rest of the people will forget what happened!!!!!

Think you can handle it without us by decrypting your servers and data using some IT Solution from third-party "specialists"?
- they will only make significant damage to all of your data; every encrypted file will be corrupted forever. Only our Decryption Tool will make decryption guaranteed;  

Think your partner IT Recovery Company will do files restoration? 
- no they will not do restoration, only take 3-4 weeks for nothing; besides all of your data is on our servers and we can publish it at any time; 
  as well as send the info about the data breach from your company servers to your key partners and clients, competitors, media and youtubers, etc. 
  Those actions from our side towards your company will have irreversible negative consequences for your business reputation.

You don't care in any case, because you just don't want to pay? 
- We will make you business stop forever by using all of our experience to make your partners, clients, employees and whoever cooperates with your company change their minds by having no choice but to stay away from your company. 
  As a result, in midterm you will have to close your business. 

So lets get straight to the point.

What do we offer in exchange on your payment:
- decryption and restoration of all your systems and data within 24 hours with guarantee;
- never inform anyone about the data breach out from your company;
- after data decryption and system restoration, we will delete all of your data from your servers forever;
- provide valuable advising on your company IT protection so no one can attack your again.

Now, in order to start negotiations, you need to do the following: 
- install and run 'Tor Browser' from https://www.torproject.org/download/
- use 'Tor Browser' open http://pod4gkypkd6kykwoht3kioehhpoh4k75ybdfoe6q7hqbphrd77b32jqd.onion/
- enter your Client ID: [snip]

There will be no bad news for your company after successful negotiations for both sides. But there will be plenty of those bad news if case of failed negotiations, so don't think about how to avoid it.
Just focus on negotiations, payment and decryption to make all of your problems solved by our specialists within 1 day after payment received: servers and data restored, everything will work good as new.

************************************************

Hello!

Visit our Blog: 
    Tor Browser Links:
        http://ransomxifxwc5eteopdobynonjctkxxvap77yqifu2emfbecgbqdw6qd.onion/
    Links for normal browser:
        http://ransomxifxwc5eteopdobynonjctkxxvap77yqifu2emfbecgbqdw6qd.onion.ly/


>>> Your data is stolen and encrypted.

If you don't pay the ransom, the data will be published on our TOR darknet sites. Keep in mind that once your data appears on our leak site, it could be bought by your competitors at any second, so don't hesitate for a long time. The sooner you pay the ransom, the sooner your company will be safe.


>>> If you have an external or cloud backup; what happens if you don’t agree with us?

All countries have their own PDPL (Personal Data Protection Law) regulations. In the event that you do not agree with us, information pertaining to your companies and the data of your company’s customers will be published on the internet, and the respective country’s personal data usage authority will be informed. Moreover, confidential data related to your company will be shared with potential competitors through email and social media. You can be sure that you will incur damages far exceeding the amount we are requesting from you should you decide not to agree with us.


>>> How to contact with us? 

- Install and run 'Tor Browser' from https://www.torproject.org/download/
- Go to http://cki3klxqycazagx3r5prae3nmfvxmwa34beknr3il4uf76vxd76akqid.onion/
- Log in using the Client ID: [snip]


>>> WARNING

DO NOT MODIFY ENCRYPTED FILES YOURSELF.
DO NOT USE THIRD PARTY SOFTWARE TO RESTORE YOUR DATA.
YOU MAY DAMAGE YOUR FILES, IT WILL RESULT IN PERMANENT DATA LOSS.


This link (TOR) is your private blog link. Right now it is only available to you but in 72 hours if you don't get in touch it will be published on our platform and will be seen by thousands of journalists: ransomxifxwc5eteopdobynonjctkxxvap77yqifu2emfbecgbqdw6qd.onion/[snip]/

Hello!

Visit our Blog: 
    Tor Browser Links:
        http://ransomxifxwc5eteopdobynonjctkxxvap77yqifu2emfbecgbqdw6qd.onion/
    Links for normal browser:
        http://ransomxifxwc5eteopdobynonjctkxxvap77yqifu2emfbecgbqdw6qd.onion.ly/


>>> Your data is stolen and encrypted.

If you don't pay the ransom, the data will be published on our TOR darknet sites. Keep in mind that once your data appears on our leak site, it could be bought by your competitors at any second, so don't hesitate for a long time. The sooner you pay the ransom, the sooner your company will be safe.


>>> If you have an external or cloud backup; what happens if you don’t agree with us?

All countries have their own PDPL (Personal Data Protection Law) regulations. In the event that you do not agree with us, information pertaining to your companies and the data of your company’s customers will be published on the internet, and the respective country’s personal data usage authority will be informed. Moreover, confidential data related to your company will be shared with potential competitors through email and social media. You can be sure that you will incur damages far exceeding the amount we are requesting from you should you decide not to agree with us.


>>> How to contact with us? 

- Install and run 'Tor Browser' from https://www.torproject.org/download/
- Go to http://davtdavm734bl4hkr3sr4dvfzpdzuzei2zrcor4vte4a3xuok2rxcmyd.onion/
- Log in using the Client ID: [snip]


>>> WARNING

DO NOT MODIFY ENCRYPTED FILES YOURSELF.
DO NOT USE THIRD PARTY SOFTWARE TO RESTORE YOUR DATA.
YOU MAY DAMAGE YOUR FILES, IT WILL RESULT IN PERMANENT DATA LOSS.

Ransom-note text from RansomLook, licensed CC BY 4.0.