RansomHub: New Ransomware with Origins in Older Knight
Essential information
- Published
- 06/06/2024 07:46
- Modified
- 06/06/2024 08:09
- Tags
- 2024-06-06 CVE-2020-1472 affiliates cyclops blink knight ransomhub ransomware-as-a-service rebranded snatch zerologon
- Related entities
- 1 vulnerabilities (cve), 14 observables, 1 intrusion sets (apt), 20 techniques (mitre), 4 malware
Description
A rapidly emerging operation called RansomHub has rapidly grown into one of the largest ransomware threats currently active. Analysis reveals RansomHub is likely an updated and rebranded version of the older Knight ransomware, suggesting the developers bought Knight's source code after its developers ceased operations and revamped it. Despite shared origins, the current operators are unlikely the original Knight creators, but rather experienced actors in the cybercriminal underground who successfully attracted former affiliates of defunct groups like Noberus. Key similarities include code overlap, nearly identical help menus, string obfuscation techniques, and ransom note structure, indicating Knight formed the foundation for RansomHub.