Malware Spotlight: RansomHub Ransomware

Report

Malware Spotlight: RansomHub Ransomware

Jan 8, 2025

Arete Analysis

Download The Report

Executive Summary

In 2024, Arete’s Incident Response (IR) team responded to dozens of incidents attributed to the RansomHub threat actor group. Engagements attributed to RansomHub increased rapidly since Arete first observed them in May 2024, and the group quickly established itself as one of the top three threat actor groups since
July 2024.

RansomHub has impacted multiple sectors across Arete engagements, including professional services, public services, healthcare, high technology, financial services, and manufacturing. The group has targeted several high-profile targets since its emergence, including telecom giant Frontier and British auction house Christie’s. RansomHub also claimed to possess data stolen from Change Healthcare, which was the victim of an ALPHV/BlackCat ransomware attack in February 2024. RansomHub announced the sale of Change’s data after leaking some of the alleged data a day beforehand.

Advertisements for the RansomHub Ransomware-as-a-Service (RaaS) appeared on cybercriminal forums on February 2, 2024, highlighting an encryptor developed using the C++ and Go programming languages. The use of Go makes it easier for ransomware groups to target a wide variety of operating systems without needing to rewrite significant portions of the malware, as Go allows developers to compile executables for Windows, Linux, and macOS platforms from a single codebase. These advertisements were accompanied by
a new data leak site (DLS) under the RansomHub branding on the dark web.

RansomHub is suspected to be a re-brand of the “Knight” ransomware group, whose source code was listed for sale on the underground RAMP forum on February 18, 2024. From research, Arete can confirm various similarities between RansomHub and Knight’s encryptors.

This spotlight explores the ransomware group’s observed behavior, background information on the threat actor, and statistics from Incident Response engagements, along with a technical analysis of RansomHub’s ransomware executable. Finally, we discuss security recommendations to better defend against this evolving cyber threat and mitigate the risk of financial and reputational losses.

Incident Response Data on the RansomHub Ransomware Group

The information provided below is based on engagements involving the RansomHub threat actor group 
investigated by Arete in 2024. Our IR, Threat Intelligence, and Data Analytics teams work together 
to analyze key data points during every ransomware engagement and form real-time 
threat actor (TA) insights.
- Targeted sectors include professional services, public services, healthcare, high technology, 
  financial services, and manufacturing.
- The median initial ransom demand is $900,000.
- The median ransom payment facilitated is $350,000.
- Tools and malware observed during investigations include SocGholish, CobaltStrike, Mimikatz, 
  Rclone, Filezilla, WinSCP, PsExec, AnyDesk, PuTTY, WinSCP, Rclone, SoftPerfect Network Scanner, 
  and TDSSKiller and EDRKillShifter to disable EDR software to evade detection.
- RansomHub-affiliated actors have exploited vulnerabilities in a variety of technologies, 
  including Apache ActiveMQ, Atlassian Confluence, Citrix ADC, F5 BIG-IP, and Fortinet FortiOS.
- The group operates a data leak site (DLS) self-proclaimed as “RansomHub” and commonly threatens 
  victims with releasing stolen data as a pressure tactic if a payment is not made.
- The file extension appended to encrypted files is created based on the first six characters of 
  the Curve 25519 public key, and files are encrypted using a decrypted Curve 25519 public key and 
  AES algorithms.
- The ransom note created self-identifies the group as RansomHub and references their data leak 
  and chat negotiation sites. The filename of the ransom note is dependent on the encrypted file 
  extension as a naming convention and follows this format: “README_.txt”. For example: README_11f5ew.txt.
- In addition to encrypting files and creating a ransom note, the RansomHub ransomware needs a 
  password to properly execute, supports various command line arguments, deletes volume shadow 
  copies, clears the Windows Event Logs, and tries to stop virtual machines (VMs)

The information provided below is based on engagements involving the RansomHub threat actor group 
investigated by Arete in 2024. Our IR, Threat Intelligence, and Data Analytics teams work together 
to analyze key data points during every ransomware engagement and form real-time 
threat actor (TA) insights.
- Targeted sectors include professional services, public services, healthcare, high technology, 
  financial services, and manufacturing.
- The median initial ransom demand is $900,000.
- The median ransom payment facilitated is $350,000.
- Tools and malware observed during investigations include SocGholish, CobaltStrike, Mimikatz, 
  Rclone, Filezilla, WinSCP, PsExec, AnyDesk, PuTTY, WinSCP, Rclone, SoftPerfect Network Scanner, 
  and TDSSKiller and EDRKillShifter to disable EDR software to evade detection.
- RansomHub-affiliated actors have exploited vulnerabilities in a variety of technologies, 
  including Apache ActiveMQ, Atlassian Confluence, Citrix ADC, F5 BIG-IP, and Fortinet FortiOS.
- The group operates a data leak site (DLS) self-proclaimed as “RansomHub” and commonly threatens 
  victims with releasing stolen data as a pressure tactic if a payment is not made.
- The file extension appended to encrypted files is created based on the first six characters of 
  the Curve 25519 public key, and files are encrypted using a decrypted Curve 25519 public key and 
  AES algorithms.
- The ransom note created self-identifies the group as RansomHub and references their data leak 
  and chat negotiation sites. The filename of the ransom note is dependent on the encrypted file 
  extension as a naming convention and follows this format: “README_.txt”. For example: README_11f5ew.txt.
- In addition to encrypting files and creating a ransom note, the RansomHub ransomware needs a 
  password to properly execute, supports various command line arguments, deletes volume shadow 
  copies, clears the Windows Event Logs, and tries to stop virtual machines (VMs)

The information provided below is based on engagements involving the RansomHub threat actor group 
investigated by Arete in 2024. Our IR, Threat Intelligence, and Data Analytics teams work together 
to analyze key data points during every ransomware engagement and form real-time 
threat actor (TA) insights.
- Targeted sectors include professional services, public services, healthcare, high technology, 
  financial services, and manufacturing.
- The median initial ransom demand is $900,000.
- The median ransom payment facilitated is $350,000.
- Tools and malware observed during investigations include SocGholish, CobaltStrike, Mimikatz, 
  Rclone, Filezilla, WinSCP, PsExec, AnyDesk, PuTTY, WinSCP, Rclone, SoftPerfect Network Scanner, 
  and TDSSKiller and EDRKillShifter to disable EDR software to evade detection.
- RansomHub-affiliated actors have exploited vulnerabilities in a variety of technologies, 
  including Apache ActiveMQ, Atlassian Confluence, Citrix ADC, F5 BIG-IP, and Fortinet FortiOS.
- The group operates a data leak site (DLS) self-proclaimed as “RansomHub” and commonly threatens 
  victims with releasing stolen data as a pressure tactic if a payment is not made.
- The file extension appended to encrypted files is created based on the first six characters of 
  the Curve 25519 public key, and files are encrypted using a decrypted Curve 25519 public key and 
  AES algorithms.
- The ransom note created self-identifies the group as RansomHub and references their data leak 
  and chat negotiation sites. The filename of the ransom note is dependent on the encrypted file 
  extension as a naming convention and follows this format: “README_.txt”. For example: README_11f5ew.txt.
- In addition to encrypting files and creating a ransom note, the RansomHub ransomware needs a 
  password to properly execute, supports various command line arguments, deletes volume shadow 
  copies, clears the Windows Event Logs, and tries to stop virtual machines (VMs)

Background

RansomHub became a notable ransomware operation in 2024, and, alongside Akira, represented a verysignificant percentage of Arete Incident Response engagements in Q3 of 2024.

Source: Arete's Q3 2024 Crimeware Report

The group utilizes both Windows and Linux variants of encryptors, which increases its operational capability to target a wide range of victims of various sectors and sizes. RansomHub operates under a double extortion model, which involves exfiltrating sensitive data and encrypting the victims’ systems to coerce a payment for
a decryptor and data deletion.

Technical Analysis

Malware analysis revealed that RansomHub ransomware:

Supports multiple command-line arguments.
Requires a password to properly execute and encrypt files.
Encrypts files on the system and mounted shares.
Creates a ransom note with the following filename: .README_.txt
Self-identifies the group as RansomHub in the ransom note.
References a data leak site in the ransom note that, when accessed, self-identifies the group as RansomHub.
Kills a list of processes and services.
Maintains a list of whitelisted files and directories to make sure it will not render the system unusable, preventing recovery when running a decryptor.
Attempts to prevent system recovery by deleting the system’s volume shadow copies.
Clears the Windows event logs.
Creates a desktop wallpaper image in the “%temp%\” directory and later modifies a registry key to change desktop wallpaper.

Execution Pattern/Arguments

The RansomHub ransomware needs command line arguments to execute and encrypt files in the system.

Command line arguments supported:

Command line arguments	Description
-cmd	CMD to be executed before encryption.
-disable-net	Disable network before running.
-fast value	Fast encryption mode.
-file value	Only process file inside defined files. For example, -file C://1.txt, -file D://2.txt.
-host value	Only process net share inside defined hosts. -host 10.10.10.10 -host 10.10.10.11.
-only-local	Only encrypt local disks.
-pass [SHA256 string]	Password needed to execute the ransomware. A 64-character string.
-path value	Only process files inside defined paths. -path C:// -path D:// -path //10.10.10.10/d/
-safeboot	Reboot in Safe Mode before running.
-safeboot-instance	Run as Safe Mode instance.
-skip-vm value	Skip shutting down VMs. Example: -skip-vm “Ubuntu 22.04 LTS”, -skip-vm “Windows Server 2012”.
-sleep [integer value]	Sleep for a period of time to run (minute).
-verbose	Log to console.

Ransomware execution with the command line argument –help:

Figure 1. Command line arguments supported by the ransomware

The ransomware will not execute in the system without the “-pass” argument followed by a SHA-256 value that is unique in each engagement. Execution of ransomware to encrypt files:

RansomHub.exe -pass [SHA-256]

Example:
RansomHub.exe -pass

7ac8cd689f5d9f4c1ddca14ec84965ed42b17343ebe086076ba0e7a46a80f81f

Once the SHA-256 password value is provided, the ransomware will decrypt a JSON based ransomware configuration at the run time.

Decrypted JSON field name and descriptions:

Name	Description
master_public_key	Curve25519 public key used in the file encryption process.
extension	Extension added to encrypted files.
note_file_name	Ransom note file name, default value is .README<encrypted_file_extension>.txt
note_full_text	Ransom note content.
settings	Ransomware operation setting. Example: { “local_disks”: true, “network_shares”: true, “kill_processes”: true, “kill_services”: true, “set_wallpaper”: true, “net_spread”: true, “self_delete”: false, “running_one”: true }
credentials	Contains common or locally stolen credentials which are used for propagation and further infection.
kill_services	Terminates list of services.
kill_processes	Terminates list of processes.
white_folders	Excludes listed directories.
white_files	Excludes listed files.
white_hosts	Excludes listed hosts.

Stop Services and Processes

Before file encryption, the ransomware terminates a pre-determined list of processes and services to encrypt as many files as possible.

Process names:

“agntsvc.exe”, “dbeng50.exe”, “dbsnmp.exe”, “encsvc.exe”, “excel.exe”, “firefox.exe”, “infopath.exe”, “isqlplussvc.exe”, “msaccess.exe”, “mspub.exe”, “mydesktopqos.exe”, “mydesktopservice.exe”, “notepad.exe”, “ocautoupds.exe”, “ocomm.exe”, “ocssd.exe”, “onenote.exe”, “oracle.exe”, “outlook.exe”, “powerpnt.exe”, “sqbcoreservice.exe”, “sql.exe”, “steam.exe”, “synctime.exe”, “tbirdconfig.exe”, “thebat.exe”, “thunderbird.exe”, “visio.exe”, “winword.exe”, “wordpad.exe”, “xfssvccon.exe”, “sql.exe”, “bedbh.exe”, “vxmon.exe”, “benetns.exe”, “bengien.exe”, “pvlsvr.exe”, “beserver.exe”, “raw_agent_svc.exe”, “vsnapvss.exe”, “CagService.exe”, “QBIDPService.exe”, “QBDBMgrN.exe”, “QBCFMonitorService.exe”, “SAP.exe”, “TeamViewer_Service.exe”, “TeamViewer.exe”, “tv_w32.exe”, “tv_x64.exe”, “CVMountd.exe”, “cvd.exe”, “cvfwd.exe”, “CVODS.exe”, “saphostexec.exe”, “saposcol.exe”, “sapstartsrv.exe”, “avagent.exe”, “avscc.exe”, “DellSystemDetect.exe”, “EnterpriseClient.exe”, “VeeamNFSSvc.exe”, “VeeamTransportSvc.exe”, “VeeamDeploymentSvc.exe”

Services names:

“mepocs”, “memtas”, “veeam”, “svc$”, “backup”, “sql”, “vss”, “sql$”, “mysql”, “mysql$”, “sophos”, “MSExchange”, “MSExchange$”, “WSBExchange”, “PDVFSService”, “BackupExecVSSProvider”, “BackupExecAgentAccelerator”, “BackupExecAgentBrowser”, “BackupExecDiveciMediaService”, “BackupExecJobEngine”, “BackupExecManagementService”, “BackupExecRPCService”, “GxBlr”, “GxVss”, “GxClMgrS”, “GxCVD”, “GxCIMgr”, “GXMMM”, “GxVssHWProv”, “GxFWD”, “SAPService”, “SAP”, “SAP$”, “SAPD$”, “SAPHostControl”, “SAPHostExec”, “QBCFMonitorService”, “QBDBMgrN”, “QBIDPService”, “AcronisAgent”, “VeeamNFSSvc”, “VeeamDeploymentService”, “VeeamTransportSvc”, “MVArmor”, “MVarmor64”, “VSNAPVSS”, “AcrSch2Svc”

The ransomware also tries to list and stop VMs by executing the following PowerShell command.

powershell.exe -Command PowerShell -Command “{ Get-VM \| Stop-VM -Force }”
powershell.exe Get-VM \| Stop-VM -Force -inputFormat xml -outputFormat text

File and Directory Exclusions

The ransomware excludes system-related files and folders, ransomware-related files, and whitelisted extensions during encryption.

Excluded file and extensions:

“NTUSER.DAT”, “autorun.inf”, “boot.ini”, “desktop.ini”, “thumbs.db”, “.deskthemepack”, “.themepack”, “.theme”, “.msstyles”, “.exe”, “.drv”, “.msc”, “.dll”, “.lock”, “.sys”, “.msu”, “.lnk”, “.ps1”, “.iso”, “.inf”, “.cab”, “*.386”

Excluded directories:

“\\$windows.~ws”, “\\$windows.~bt”, “\\windows\\”, “\\windows.old”, “\\system volume information”, “\\Boot”, “\\PerfLogs”, “\\AppData\\Local\\Temp”, “\\AppData\\Local\\Microsoft\\GameDVR”, “\\ AppData\\Local\\Microsoft\\Edge”, “\\AppData\\Local\\Packages\\Microsoft.”, “\\AppData\\Local\\Packages\\ MicrosoftWindows.”, “\\AppData\\Local\\Packages\\Internet Explorer”, “\\Program Files\\Common Files\\microsoft shared”, “\\Program Files\\Common Files\\Services”, “\\Program Files\\Common Files\\System”, “\\Program Files\\Internet Explorer”, “\\Program Files\\ModifiableWindowsApps”, “\\Program Files\\Uninstall Information”, “\\Program Files\\Windows Defender”, “\\Program Files\\Windows Mail”, “\\Program Files\\Windows Media Player”, “\\Program Files\\Windows NT”, “\\Program Files\\Windows Photo Viewer”, “\\Program Files\\Windows Portable Devices”, “\\Program Files\\Windows Security”, “\\Program Files\\Windows Sidebar”, “\\Program Files\\ WindowsApps”, “\\Program Files\\WindowsPowerShell”, “\\Program Files (x86)\\Common Files”, “\\Program Files (x86)\\Common Files\\Microsoft Shared”, “\\Program Files (x86)\\Common Files\\Services”, “\\Program Files (x86)\\ Common Files\\System”, “\\Program Files (x86)\\Internet Explorer”, “\\Program Files (x86)\\Microsoft\\Edge”, “\\Program Files (x86)\\Microsoft\\Temp”, “\\Program Files (x86)\\Microsoft.NET”, “\\Program Files (x86)\\ Windows Defender”, “\\Program Files (x86)\\Windows Mail”, “\\Program Files (x86)\\Windows Media Player”, “\\Program Files (x86)\\Windows Multimedia Platform”, “\\Program Files (x86)\\Windows NT”, “\\Program Files (x86)\\Windows Photo Viewer”, “\\Program Files (x86)\\Windows Portable Devices”, “\\Program Files (x86)\\ Windows Security”, “\\Program Files (x86)\\Windows Sidebar”, “\\Program Files (x86)\\WindowsPowerShell”, “\\ ProgramData\\ssh\\”, “\\ProgramData\\USOPrivate”, “\\ProgramData\\USOShared”, “\\ProgramData\\Package Cache”, “\\ProgramData\\Microsoft\\Device Stage”, “\\ProgramData\\Microsoft\\DeviceSync”, “\\ProgramData\\ Microsoft\\Diagnosis”, “\\ProgramData\\Microsoft\\DiagnosticLogCSP”, “\\ProgramData\\Microsoft\\DRM”, “\\ ProgramData\\Microsoft\\UEV”, “\\ProgramData\\Microsoft\\EdgeUpdate”, “\\ProgramData\\Microsoft\\Event Viewer”, “\\ProgramData\\Microsoft\\IdentityCRL”, “\\ProgramData\\Microsoft\\MapData”, “\\ProgramData\\ Microsoft\\MF”, “\\ProgramData\\Microsoft\\NetFramework”, “\\ProgramData\\Microsoft\\Network”, “\\ ProgramData\\Microsoft\\Provisioning”, “\\ProgramData\\Microsoft\\Search”, “\\ProgramData\\Microsoft\\ SmsRouter”, “\\ProgramData\\Microsoft\\Spectrum”, “\\ProgramData\\Microsoft\\Speech_OneCore”, “\\ ProgramData\\Microsoft\\Storage Health”, “\\ProgramData\\Microsoft\\User Account Pictures”, “\\ProgramData\\ Microsoft\\Vault”, “\\ProgramData\\Microsoft\\WDF”, “\\ProgramData\\Microsoft\\Windows”, “\\ProgramData\\ Microsoft\\Windows Defender”, “\\ProgramData\\Microsoft\\Windows NT”, “\\ProgramData\\Microsoft\\ Windows Security Health”, “\\ProgramData\\Microsoft\\WinMSIPC”, “\\ProgramData\\Microsoft\\WPD”, “\\ ProgramData\\Packages\\USOPrivate”, “\\ProgramData\\Packages\\USOShared”, “\\ProgramData\\Packages\\ WindowsHolographicDevices”, “\\ProgramData\\Packages\\MicrosoftWindows.”, “\\ProgramData\\Packages\\ Microsoft.”

Inhibit System Recovery

Windows operating systems contain features that can help fix corrupted system files, including shadow copies, which are backups of files created by the Volume Shadow Copy Service (VSS). By deleting shadow copies, the ransomware can prevent victims from restoring files from backups, making it more difficult for them to recover their data without paying the ransom.

The ransomware deletes volume shadow copies before file encryption by starting the following process:

powershell.exe -Command PowerShell -Command “\”Get-CimInstance Win32_ShadowCopy \| Remove-CimInstance\””

System Network Connections Discovery

The ransomware can enumerate network-mounted shares by scanning the network interfaces.

Data Encrypted for Impact

The ransomware initially finds available drives, then loads the files one by one using the Windows API “FindFirstFileW“ and “FindNextFileW”. The ransomware generates random keys to encrypt the files, and after encrypting them, the keys are encrypted using a public key. To encrypt files, the ransomware uses a combination of a decrypted Curve 25519 public key and AES algorithms.

The default extension value is the first six characters of the Curve 25519 public key.

Figure 2. Extension added to the encrypted files

Files smaller than 0x100000 bytes are completely encrypted. If the file size is larger than 0x100000 bytes, the ransomware encrypts the file in 0x100000 bytes blocks and skips every 0x200000 bytes of data in between encrypted chunks.

Figure 3. 0x100000 bytes encrypted file.

Upon successful execution, the ransomware creates ransom notes with the file name “README_[encrypted_file_extension].txt”

Figure 4. RansomHub ransom note

Ransom note content:

We are the RansomHub.

Your company Servers are locked and Data has been taken to our servers. This is serious.

Good news:
– your server system and data will be restored by our Decryption Tool, we support trial decryption to prove that your files can be decrypted;
– for now, your data is secured and safely stored on our server;
– nobody in the world is aware about the data leak from your company except you and RansomHub team;
– we provide free trial decryption for files smaller than 1MB. If anyone claims they can decrypt our files, you can ask them to try to decrypt a file larger than 1MB.

FAQs:
Who we are?
– Normal Browser Links: https://ransomxifxwc5eteopdobynonjctkxxvap77yqifu2emfbecgbqdw6qd[.]onion.ly/
– Tor Browser Links: http://ransomxifxwc5eteopdobynonjctkxxvap77yqifu2emfbecgbqdw6qd[.]onion/

Want to go to authorities for protection?
– Seeking their help will only make the situation worse,They will try to prevent you from negotiating with us, because the negotiations will make them look incompetent,After the incident report is handed over to the government
department, you will be fined <This will be a huge amount,Read more about the GDRP legislation: https://en.wikipedia.org/wiki/General_Data_Protection_Regulation>, The government uses your fine to reward them.And you will not get anything, and except you and your company, the rest of the people will forget what happened!!!!!

Think you can handle it without us by decrypting your servers and data using some IT Solution from third-party “specialists”?
– they will only make significant damage to all of your data; every encrypted file will be corrupted forever. Only our Decryption Tool will make decryption guaranteed;

Don’t go to recovery companies, they are essentially just middlemen who will make money off you and cheat you.
– We are well aware of cases where recovery companies tell you that the ransom price is 5 million dollars, but in fact they secretly negotiate with us for 1 million dollars, so they earn 4 million dollars from you. If you approached us directly without intermediaries you would pay 5 times less, that is 1 million dollars.

Think your partner IT Recovery Company will do files restoration?
– no they will not do restoration, only take 3-4 weeks for nothing; besides all of your data is on our servers and we can publish it at any time; as well as send the info about the data breach from your company servers to your key partners and clients,
competitors, media and youtubers, etc. Those actions from our side towards your company will have irreversible negative consequences for your business
reputation.

You don’t care in any case, because you just don’t want to pay?
– We will make you business stop forever by using all of our experience to make your partners, clients, employees and whoever cooperates with your company change their minds by having no choice but to stay away from your company.
As a result, in midterm you will have to close your business.

So lets get straight to the point.

What do we offer in exchange on your payment:
– decryption and restoration of all your systems and data within 24 hours with guarantee;
– never inform anyone about the data breach out from your company;
– after data decryption and system restoration, we will delete all of your data from our servers forever;
– provide valuable advising on your company IT protection so no one can attack your again.

Now, in order to start negotiations, you need to do the following:
– install and run ‘Tor Browser’ from https://www.torproject.org/download/
– use ‘Tor Browser’ open <TA_URL_removed_by_analyst>.onion/
– enter your Client ID: <ID_removed_by_analyst>
* do not leak your ID or you will be banned and will never be able to decrypt your files.

There will be no bad news for your company after successful negotiations for both sides. But there will be plenty of those bad news if case of failed negotiations, so don’t think about how to avoid it. Just focus on negotiations, payment and decryption to make all of your problems solved by our specialists within 1
day after payment received: servers and data restored, everything will work good as new.

************************************************

Modify Registry

The ransomware performs a registry key modification to change the desktop wallpaper.

Registry key change:

Registry key	Value name	Value data
Computer\HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\ CurrentVersion\Explorer\Wallpapers	BackgroundHistory Path0	C:\Users\%USERNAME%\ AppData\Local\Temp\MkgXoB.png

Registry key

Value name

Value data

Computer\HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\

CurrentVersion\Explorer\Wallpapers

BackgroundHistory
Path0

C:\Users\%USERNAME%\
AppData\Local\Temp\MkgXoB.png

Screenshot showing the registry key modification:

Wallpaper image content from the
C:\Users\%USERNAME%\AppData\Local\Temp\MkgXoB.png file:

Mutex

The mutex is the fundamental tool for managing shared resources between multiple threads or processes. Typically, ransomware uses a mutex to avoid reinfecting the victim system and causing multiple layers of encryption. The ransomware did not create a mutex during execution.

Network Activity

The ransomware did not try to communicate with a remote server other than encrypting data from mounted shares.

Indicator Removal

The ransomware clears Windows Event Logs to hide its malicious activity. Windows Event Logs keep a record of a computer’s alerts and notifications. The ransomware runs the following commands to clear the logs:

cmd.exe /c wevtutil cl security cmd.exe /c wevtutil cl system cmd.exe /c wevtutil cl application

File and Directory Permissions Modification

The ransomware uses the fsutil tool to redirect file system access to a different location after gaining access to a compromised network. The ransomware uses the following command line to redirect file system access, enabling remote to remote and remote to local symbolic links:

fsutil behavior set SymlinkEvaluation R2L:1 fsutil behavior set SymlinkEvaluation R2R:1

Indicators of Compromise

Indicator	Type	Context
de7913504efe4584bdd9dd1ec13c4de4152a84df5e1cb-c31d0dd8fe70c88b5e0 4ac0e6c804f638182ee8e23c37e0c474a22f8bc2b3eed5ac-c0a56764839e4106 83654c500c68418142e43b31ebbec040d9d36cfbbe08c7b9b-3dc90fabc14801a eaee06cb53ff473f32d02ad1aca38957812b394f69dd0a3d2af-16f2d923b10e3	SHA256 hash	RansomHub ransomware
README_<encrypted_file_extension>.txt	File name	RansomHub ransom note
powershell.exe -Command PowerShell -Command “{ Get-VM \| Stop-VM -Force }”	Process	Retrieve information about VMs and forces a shutdown
powershell.exe -Command PowerShell -Command ” \\”Get-CimInstance Win32_ShadowCopy \| Remove-CimInstance\\”” cmd.exe /c “\\”vssadmin.exe Delete Shadows /all /quiet\\””	Process	Volume Shadow Copy deletion
cmd.exe /c wevtutil cl security cmd.exe /c wevtutil cl system cmd.exe /c wevtutil cl application	Process	Clearing Windows Event Logs
cmd.exe /c “\\”fsutil behavior set SymlinkEvaluation R2L:1\\”” cmd.exe /c “\\”fsutil behavior set SymlinkEvaluation R2R:1\\””	Process	Enable remote to remote and remote to local symbolic links
Key: Computer\HKEY_CURRENT_USER\SOFTWARE\Microsoft\ Windows\CurrentVersion\Explorer\Wallpapers Value: BackgroundHistoryPath0 Data: C:\Users\%USERNAME%\AppData\Local\Temp\MkgXoB. png	Registry	Desktop wallpaper modification
ransomxifxwc5eteopdobynonjctkxxvap77yqifu2emfbecgbqdw6qd[.] onion	URL	TA data leak site (DLS)

Ransomware Configuration

RansomHub decrypted configuration information extracted:

{"master_public_key": <public_key_removed_by_analyst> "extension": 
"<extension_removed_by_analyst>" "note_file_name": 
"README_<extension_removed_by_analyst>.txt", "note_full_text": "We are the RansomHub.
\n\nYour company Servers are locked and Data has been taken to our servers. This is serious. 
\n\nGood news:\n- your server system and data will be restored by our Decryption Tool, we supply 
trial decryption to prove that your files can be decrypted;\n- for now, your data is secured and
safely stored on our server;\n- nobody in the world is aware about the data leak from your company 
except you and RansomHub team;\n- we provide free trial decryption for files smaller than 1MB. If 
anyone claims they can decrypt our files, you can ask them to try to decrypt a file larger than 
1MB.\n\nFAQs:\nWho we are?\n- Normal Browser Links: https://ransomxifxwc5eteopdobynonjctkxvap77yqifu2emfbecbqdw6qd.onion.ly/\n- 
Tor Browser 
Links: 
http://ransomxifxwc5eteopdobynonjctkxvap77yqifu2emfbecbqdw6qd.onion/\n\nWant to go to authorities 
for protection?\n- Seeking their help will only make the situation worse,They will try to prevent 
you from negotiating with us, because the negotiations will make them look incompetent,After the 
incident report is handed over to the government department, you will be fined 
<This will be a huge amount,Read more about the GDRP legislation:https://
en.wikipedia.org/wiki/General_Data_Protection_Regulation> The government uses your fine to reward 
them.And you will not get anything, and except you and your company, the rest of the people will 
forget what happened!!!!!\n\nThink you can handle it without us by decrypting your servers and 
data using some IT Solution from third-party \"specialists\"?\n- they will only make significant 
damage to all of your data; every encrypted file will be corrupted forever. Only our Decryption 
Tool will make decryption guaranteed;\nDon't go to recovery companies, they are essentially just 
middlemen who will make money off you and cheat you. \n- We are well aware of cases where recovery 
companies tell you that the ransom price is 5 million dollars, but in fact they secretly negotiate 
with us for 1 million dollars, so they earn 4 million dollars from you. If you approached us 
directly without intermediaries you would pay 5 times less, that is 1 million dollars.\n\nThink 
your partner IT Recovery Company will do files restoration?\n- no they will not do restoration, 
only take 3-4 weeks for nothing; besides all of your data is on our server and we can publish it 
at any time; \n as well as send the info about the data breach from your company servers to your 
key partners and clients, competitors, media and youtubers, etc. \n Those actions from our side 
towards your company will have irreversible negative consequences for your business reputation.
\n\nYou don't care in any case, because you just don't want to pay? \n- We will make you business 
stop forever by using all of our experience to make your partners, clients, employees and whoever 
cooperates with your company change their minds by having no choice but to stay away from your 
company. \nAs a result, in midterm you will have to close your business. \n\nSo lets get straight 
to the point.\n\nWhat do we offer in exchange on your payment:\n- decryption and restoration of all 
your systems and data within 24 hours with guarantee;\n- never inform anyone about the data breach 
out from your company;\n- after data decryption and system restoration, we will delete all of your 
data from our servers forever;\n- provide valuable advising on your company IT protection so no 
one can hack you again.\n\nNow, in order to start negotiations, you need to do the following:\n- 
install and run 'Tor Browser' from https://www.torproject.org/download/\n- use 'Tor Browser' 
open <TA_URL_removed_by_analyst> \n- enter your ID or you will be banned and will never be able to 
decrypt your files.\n\nThere will be live chat for your company after successful negotiations for 
both sides. But there will be plenty of those bad cases of failed negotiations, so don't think about 
how to avoid it.\nJust focus on negotiations, payment and describe to make all of your problems 
solved by our specialists within 1 day after payment received: servers and data restored, 
everything will work good as new.\n\n************************************************\n",
"note_short_text": "Your data is stolen and encrypted, see README_<extension_removed_by_analyst>.txt.", "settings": 
  {"local_disks"

{"master_public_key": <public_key_removed_by_analyst> "extension": 
"<extension_removed_by_analyst>" "note_file_name": 
"README_<extension_removed_by_analyst>.txt", "note_full_text": "We are the RansomHub.
\n\nYour company Servers are locked and Data has been taken to our servers. This is serious. 
\n\nGood news:\n- your server system and data will be restored by our Decryption Tool, we supply 
trial decryption to prove that your files can be decrypted;\n- for now, your data is secured and
safely stored on our server;\n- nobody in the world is aware about the data leak from your company 
except you and RansomHub team;\n- we provide free trial decryption for files smaller than 1MB. If 
anyone claims they can decrypt our files, you can ask them to try to decrypt a file larger than 
1MB.\n\nFAQs:\nWho we are?\n- Normal Browser Links: https://ransomxifxwc5eteopdobynonjctkxvap77yqifu2emfbecbqdw6qd.onion.ly/\n- 
Tor Browser 
Links: 
http://ransomxifxwc5eteopdobynonjctkxvap77yqifu2emfbecbqdw6qd.onion/\n\nWant to go to authorities 
for protection?\n- Seeking their help will only make the situation worse,They will try to prevent 
you from negotiating with us, because the negotiations will make them look incompetent,After the 
incident report is handed over to the government department, you will be fined 
<This will be a huge amount,Read more about the GDRP legislation:https://
en.wikipedia.org/wiki/General_Data_Protection_Regulation> The government uses your fine to reward 
them.And you will not get anything, and except you and your company, the rest of the people will 
forget what happened!!!!!\n\nThink you can handle it without us by decrypting your servers and 
data using some IT Solution from third-party \"specialists\"?\n- they will only make significant 
damage to all of your data; every encrypted file will be corrupted forever. Only our Decryption 
Tool will make decryption guaranteed;\nDon't go to recovery companies, they are essentially just 
middlemen who will make money off you and cheat you. \n- We are well aware of cases where recovery 
companies tell you that the ransom price is 5 million dollars, but in fact they secretly negotiate 
with us for 1 million dollars, so they earn 4 million dollars from you. If you approached us 
directly without intermediaries you would pay 5 times less, that is 1 million dollars.\n\nThink 
your partner IT Recovery Company will do files restoration?\n- no they will not do restoration, 
only take 3-4 weeks for nothing; besides all of your data is on our server and we can publish it 
at any time; \n as well as send the info about the data breach from your company servers to your 
key partners and clients, competitors, media and youtubers, etc. \n Those actions from our side 
towards your company will have irreversible negative consequences for your business reputation.
\n\nYou don't care in any case, because you just don't want to pay? \n- We will make you business 
stop forever by using all of our experience to make your partners, clients, employees and whoever 
cooperates with your company change their minds by having no choice but to stay away from your 
company. \nAs a result, in midterm you will have to close your business. \n\nSo lets get straight 
to the point.\n\nWhat do we offer in exchange on your payment:\n- decryption and restoration of all 
your systems and data within 24 hours with guarantee;\n- never inform anyone about the data breach 
out from your company;\n- after data decryption and system restoration, we will delete all of your 
data from our servers forever;\n- provide valuable advising on your company IT protection so no 
one can hack you again.\n\nNow, in order to start negotiations, you need to do the following:\n- 
install and run 'Tor Browser' from https://www.torproject.org/download/\n- use 'Tor Browser' 
open <TA_URL_removed_by_analyst> \n- enter your ID or you will be banned and will never be able to 
decrypt your files.\n\nThere will be live chat for your company after successful negotiations for 
both sides. But there will be plenty of those bad cases of failed negotiations, so don't think about 
how to avoid it.\nJust focus on negotiations, payment and describe to make all of your problems 
solved by our specialists within 1 day after payment received: servers and data restored, 
everything will work good as new.\n\n************************************************\n",
"note_short_text": "Your data is stolen and encrypted, see README_<extension_removed_by_analyst>.txt.", "settings": 
  {"local_disks"

{"master_public_key": <public_key_removed_by_analyst> "extension": 
"<extension_removed_by_analyst>" "note_file_name": 
"README_<extension_removed_by_analyst>.txt", "note_full_text": "We are the RansomHub.
\n\nYour company Servers are locked and Data has been taken to our servers. This is serious. 
\n\nGood news:\n- your server system and data will be restored by our Decryption Tool, we supply 
trial decryption to prove that your files can be decrypted;\n- for now, your data is secured and
safely stored on our server;\n- nobody in the world is aware about the data leak from your company 
except you and RansomHub team;\n- we provide free trial decryption for files smaller than 1MB. If 
anyone claims they can decrypt our files, you can ask them to try to decrypt a file larger than 
1MB.\n\nFAQs:\nWho we are?\n- Normal Browser Links: https://ransomxifxwc5eteopdobynonjctkxvap77yqifu2emfbecbqdw6qd.onion.ly/\n- 
Tor Browser 
Links: 
http://ransomxifxwc5eteopdobynonjctkxvap77yqifu2emfbecbqdw6qd.onion/\n\nWant to go to authorities 
for protection?\n- Seeking their help will only make the situation worse,They will try to prevent 
you from negotiating with us, because the negotiations will make them look incompetent,After the 
incident report is handed over to the government department, you will be fined 
<This will be a huge amount,Read more about the GDRP legislation:https://
en.wikipedia.org/wiki/General_Data_Protection_Regulation> The government uses your fine to reward 
them.And you will not get anything, and except you and your company, the rest of the people will 
forget what happened!!!!!\n\nThink you can handle it without us by decrypting your servers and 
data using some IT Solution from third-party \"specialists\"?\n- they will only make significant 
damage to all of your data; every encrypted file will be corrupted forever. Only our Decryption 
Tool will make decryption guaranteed;\nDon't go to recovery companies, they are essentially just 
middlemen who will make money off you and cheat you. \n- We are well aware of cases where recovery 
companies tell you that the ransom price is 5 million dollars, but in fact they secretly negotiate 
with us for 1 million dollars, so they earn 4 million dollars from you. If you approached us 
directly without intermediaries you would pay 5 times less, that is 1 million dollars.\n\nThink 
your partner IT Recovery Company will do files restoration?\n- no they will not do restoration, 
only take 3-4 weeks for nothing; besides all of your data is on our server and we can publish it 
at any time; \n as well as send the info about the data breach from your company servers to your 
key partners and clients, competitors, media and youtubers, etc. \n Those actions from our side 
towards your company will have irreversible negative consequences for your business reputation.
\n\nYou don't care in any case, because you just don't want to pay? \n- We will make you business 
stop forever by using all of our experience to make your partners, clients, employees and whoever 
cooperates with your company change their minds by having no choice but to stay away from your 
company. \nAs a result, in midterm you will have to close your business. \n\nSo lets get straight 
to the point.\n\nWhat do we offer in exchange on your payment:\n- decryption and restoration of all 
your systems and data within 24 hours with guarantee;\n- never inform anyone about the data breach 
out from your company;\n- after data decryption and system restoration, we will delete all of your 
data from our servers forever;\n- provide valuable advising on your company IT protection so no 
one can hack you again.\n\nNow, in order to start negotiations, you need to do the following:\n- 
install and run 'Tor Browser' from https://www.torproject.org/download/\n- use 'Tor Browser' 
open <TA_URL_removed_by_analyst> \n- enter your ID or you will be banned and will never be able to 
decrypt your files.\n\nThere will be live chat for your company after successful negotiations for 
both sides. But there will be plenty of those bad cases of failed negotiations, so don't think about 
how to avoid it.\nJust focus on negotiations, payment and describe to make all of your problems 
solved by our specialists within 1 day after payment received: servers and data restored, 
everything will work good as new.\n\n************************************************\n",
"note_short_text": "Your data is stolen and encrypted, see README_<extension_removed_by_analyst>.txt.", "settings": 
  {"local_disks"

Data Leak Site

The RansomHub ransom note contains a data leak site (DLS) that displayed the following page, self-identifying the group as RansomHub:

Figure 5. TOR DLS

Similarities with Other Ransomware

During our analysis, we observed some similarities between RansomHub, ALPHV/BlackCat, and Knight ransomware executables.

The following table highlights some of the similarities:

Malware Family	Common Arguments	Password	JSON Configuration
RansomHub	pass safeboot safeboot-instance path help verbose fast path sleep	SHA256 strings value	extension note_file_name note_full_text note_short_text kill_processes kill_services credentials
ALPHV/BlackCat	–access-token (similar to -pass in RansomHub and Knight) safeboot safeboot-instance paths help verbose	SHA256 strings value	extension note_file_name note_full_text note_short_text kill_processes kill_services credentials
Knight	pass path verbose fast path sleep	SHA256 strings value	extension note_file_name note_full_text note_short_text kill_processes kill_services credentials

Detection Mechanisms

Custom Detections and Blocking with Arete Bloktd℠

SentinelOne S1QL 1.0 query syntax (STAR rule):

RansomHub Ransomware

EndpointOS = "windows" AND EventType = "Process Creation" AND TgtProcCmdLine RegExp 
"\.exe\s{1,3}[A-Za-z0-9-]{0,20}\s{0,3}-pass\s[A-Za-z0-9]{64}"

Volume Shadow Copy Deletion

EndpointOS = "windows" AND EventType = "Process Creation" AND TgtProcCmdLine Contains 
Anycase "powershell.exe" AND TgtProcCmdLine Contains Anycase "-Command" AND TgtProcCmdLine 
Contains Anycase "Get-CimInstance" AND TgtProcCmdLine Contains Anycase "Win32_ShadowCopy"

Windows Event Log Cleared 

EndpointOS = "windows" AND ObjectType = "process" AND TgtProcCmdLine Contains Anycase 
"wevtutil" AND TgtProcCmdLine Contains Anycase " cl " AND TgtProcCmdLine In Contains 
Anycase ("Application", "Security", "System")

SentinelOne S1QL 1.0 query syntax (STAR rule):

RansomHub Ransomware

EndpointOS = "windows" AND EventType = "Process Creation" AND TgtProcCmdLine RegExp 
"\.exe\s{1,3}[A-Za-z0-9-]{0,20}\s{0,3}-pass\s[A-Za-z0-9]{64}"

Volume Shadow Copy Deletion

EndpointOS = "windows" AND EventType = "Process Creation" AND TgtProcCmdLine Contains 
Anycase "powershell.exe" AND TgtProcCmdLine Contains Anycase "-Command" AND TgtProcCmdLine 
Contains Anycase "Get-CimInstance" AND TgtProcCmdLine Contains Anycase "Win32_ShadowCopy"

Windows Event Log Cleared 

EndpointOS = "windows" AND ObjectType = "process" AND TgtProcCmdLine Contains Anycase 
"wevtutil" AND TgtProcCmdLine Contains Anycase " cl " AND TgtProcCmdLine In Contains 
Anycase ("Application", "Security", "System")

SentinelOne S1QL 1.0 query syntax (STAR rule):

RansomHub Ransomware

EndpointOS = "windows" AND EventType = "Process Creation" AND TgtProcCmdLine RegExp 
"\.exe\s{1,3}[A-Za-z0-9-]{0,20}\s{0,3}-pass\s[A-Za-z0-9]{64}"

Volume Shadow Copy Deletion

EndpointOS = "windows" AND EventType = "Process Creation" AND TgtProcCmdLine Contains 
Anycase "powershell.exe" AND TgtProcCmdLine Contains Anycase "-Command" AND TgtProcCmdLine 
Contains Anycase "Get-CimInstance" AND TgtProcCmdLine Contains Anycase "Win32_ShadowCopy"

Windows Event Log Cleared 

EndpointOS = "windows" AND ObjectType = "process" AND TgtProcCmdLine Contains Anycase 
"wevtutil" AND TgtProcCmdLine Contains Anycase " cl " AND TgtProcCmdLine In Contains 
Anycase ("Application", "Security", "System")

Note: These threat hunting queries may need to be tuned for your specific network environment.

Yara

rule RansomHub_ransomware_executable
{

meta:

author = “areteir.com”
description = “Detects the RansomHub ransomware executable”
target = “Windows systems”
file_type = “exe”
copyright = “Copyright © 2024 by Arete Advisors, LLC.”
distribution = “No re-distribution without Arete Advisors, LLC consent.”

strings:

$s1 = “json:\”local_disks\””
$s2 = “json:\”running_one\””
$s3 = “json:\”self_delete\””
$s4 = “json:\”white_files\””
$s5 = “json:\”white_hosts\””
$s6 = “json:\”credentials\””
$s7 = “json:\”kill_services\””
$s8 = “json:\”set_wallpaper\””
$s9 = “json:\”white_folders\””
$s10 = “json:\”note_file_name\””
$s11 = “json:\”note_full_text\””
$s12 = “json:\”kill_processes\””
$s13 = “json:\”network_shares\””
$s14 = “json:\”note_short_text\””
$s15 = “json:\”master_public_key\””

condition:

((uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550)) and
(9 of ($s*))

}

Recommended Mitigations

   - Utilize an endpoint detection and response (EDR) solution with the capability to halt detected processes
    and isolate systems on the network based on identified conditions.
   - Block any known attacker C2s in the firewall.
   - Implement multi-factor authentication on RDP and VPN to restrict access to critical network resources.
   - Eliminate unnecessary RDP ports exposed to the internet.
   - Block a high number of SMB connection attempts from one system to others in the network over a short period of time.
   - Perform periodic dark web monitoring to verify if data is available for sale on the black market.
   - Perform penetration tests.
   - Periodically patch systems and update tools.
   - Monitor connections to the network from suspicious locations.
   - Monitor downloads and uploads of files to file-sharing services outside standard work hours.
   - Monitor file uploads from domain controllers to the internet.
   - Monitor network scans from uncommon servers (e.g., RDP server)

   - Utilize an endpoint detection and response (EDR) solution with the capability to halt detected processes
    and isolate systems on the network based on identified conditions.
   - Block any known attacker C2s in the firewall.
   - Implement multi-factor authentication on RDP and VPN to restrict access to critical network resources.
   - Eliminate unnecessary RDP ports exposed to the internet.
   - Block a high number of SMB connection attempts from one system to others in the network over a short period of time.
   - Perform periodic dark web monitoring to verify if data is available for sale on the black market.
   - Perform penetration tests.
   - Periodically patch systems and update tools.
   - Monitor connections to the network from suspicious locations.
   - Monitor downloads and uploads of files to file-sharing services outside standard work hours.
   - Monitor file uploads from domain controllers to the internet.
   - Monitor network scans from uncommon servers (e.g., RDP server)

   - Utilize an endpoint detection and response (EDR) solution with the capability to halt detected processes
    and isolate systems on the network based on identified conditions.
   - Block any known attacker C2s in the firewall.
   - Implement multi-factor authentication on RDP and VPN to restrict access to critical network resources.
   - Eliminate unnecessary RDP ports exposed to the internet.
   - Block a high number of SMB connection attempts from one system to others in the network over a short period of time.
   - Perform periodic dark web monitoring to verify if data is available for sale on the black market.
   - Perform penetration tests.
   - Periodically patch systems and update tools.
   - Monitor connections to the network from suspicious locations.
   - Monitor downloads and uploads of files to file-sharing services outside standard work hours.
   - Monitor file uploads from domain controllers to the internet.
   - Monitor network scans from uncommon servers (e.g., RDP server)

Organizations can find the full list of US government-recommended ransomware prevention and mitigation guidance here: https://www.cisa.gov/stopransomware/ransomware-guide

Arete provides data-driven cybersecurity solutions to transform your response to emerging cyber threats.

Click here to learn more.

References

At Arete, we envision a world without cyber extortion, where people, businesses, and governments can thrive. We are taking all that we know from over 9,000 engagements to inform our solutions and strengthen powerful tools to better prevent, detect, and respond to the cyber extortion threats of tomorrow. Our elite team of experts provides unparalleled capabilities to address the entire cyber threat lifecycle, from incident response and restoration to advisory and managed security services. To learn more about our solutions, visit www.areteir.com.

Back to Blog Posts

Article

May 12, 2026

Critical MOVEit Automation Vulnerabilities Disclosed

A security advisory released by Progress Software details critical and high-severity vulnerabilities affecting their MOVEit Automation managed file transfer (MFT) solution. The vulnerabilities, tracked as CVE-2026-4670 and CVE-2026-5174, could allow a threat actor to bypass authentication and escalate privileges, leading to unauthorized access, administrative control, and data exposure. Cybercriminals have leveraged several MFT tools in previous campaigns, including the Accellion File Transfer Application (FTA), Fortra GoAnywhere MFT, and Cleo MFT. Flaws in MFT software are highly targeted by cybercriminals due to the volume and sensitivity of the data they control.

What’s Notable and Unique

MOVEit Transfer was heavily exploited by the Cl0p ransomware group in the summer of 2023. While the window of exploit activity lasted only a few weeks, victim extortion and data leaks continued throughout the remainder of the year, leading to more than 70 class-action lawsuits filed in the U.S.
There is no workaround or hotfix for these vulnerabilities. To fully patch the flaws, MOVEit administrators need to perform a "full install" of the latest version, which will require taking the system offline.
Security researchers have discovered ~1,400 MOVEit Automation instances exposed to the internet, with dozens belonging to U.S. local and state government agencies.

Analyst Comments

While the vulnerabilities patched in Progress Software's recent release differ from the SQL injection vulnerability exploited by the Cl0p ransomware group in 2023, exploitation of CVE-2026-4670 and CVE-2026-5174 could lead to equally impactful outcomes. Beyond the immediate impacts on affected organizations, trusted data-exchange platforms provide threat actors with an avenue to obtain sensitive information and infect partner and supplier environments. Furthermore, Arete has seen the time window between disclosure and weaponization of critical vulnerabilities continue to shrink, especially as threat actors increasingly adopt AI-enabled tooling. As such, organizations should not only implement the patches released by Progress Software, but also hunt for typical post-compromise behavior like enumeration of the underlying database, the creation of new user accounts or users operating with unexpected administrator privileges, and the presence of unauthorized remote monitoring and management (RMM) tools.

Sources

MOVEit Automation Critical Security Alert Bulletin – April 2026 – (CVE-2026-4670, CVE-2026-5174)
From Breach to Courtroom: Inside the MOVEit Exploitation and Mass Litigation
Progress warns of critical MOVEit Automation auth bypass flaw

A graphic with futuristic lines showing a text saying Ransomware Trends and Data Insights, a monthly blog post.

Article

May 4, 2026

Ransomware Trends & Data Insights: April 2026

The threat landscape has remained relatively predictable thus far in 2026. In April, Qilin dethroned Akira as the most active threat group for the month. Akira, who had been the top ransomware threat each month since July 2025, was still only slightly behind Qilin and had roughly the same activity level as in March. INC Ransom and DragonForce also remained active threats in April, with those four ransomware groups accounting for half of all ransomware and extortion activity observed by Arete.

A monthly graph showing the latest threat actor accounting for half of all ransomware and extortion acitivty observed by Arete.

Figure 1. Activity from the top 3 threat groups in April 2026

Throughout the month, analysts at Arete identified several trends behind the threat actors perpetrating cybercrime activities:

Multiple ransomware operations continue to leverage the Bring Your Own Vulnerable Driver (BYOVD) technique to disable endpoint security controls prior to ransomware deployment. Qilin has recently been observed leveraging a malicious file loaded via DLL side-loading along with vulnerable drivers, including rwdrv.sys and hlpdrv.sys, to gain kernel-level access and disable security processes. Arete observed Akira using the same vulnerable drivers in multiple engagements dating back to Q3 2025.
DragonForce has leveraged several of the same tools in recent engagements, including the remote desktop application Remotely Agent and the PoisonX.sys vulnerable driver. Additionally, open-source reporting indicates that the group recently used a Python-based backdoor known as VIPERTUNNEL to maintain reliable operator access and evade detection. DragonForce was responsible for over 7% of Arete ransomware engagements in April, and Arete notes increased activity from the group this year compared to 2025.
A social engineering tactic has reemerged in recent months in which threat actors impersonate IT and helpdesk staff via Microsoft Teams to contact employees and attempt to convince them to install remote access tools like Quick Assist, giving the threat actors remote access to the victim’s environment. This tactic was initially observed in late 2024 and early 2025 and was linked to now-defunct groups like Black Basta and Cactus, but has more recently been observed in intrusions linked to the Akira and Payouts King ransomware groups.

Sources

Arete Internal

Article

Apr 28, 2026

Payouts King Utilizes QEMU Emulator to Bypass EDR

Researchers recently identified threat actor campaigns leveraging QEMU, a free open-source virtual machine (VM) emulator, to evade endpoint security solutions. Since QEMU acts as a VM within the target environment, endpoint detection tools cannot scan inside the emulator or detect any malicious files or payloads QEMU contains. Although threat actors have been utilizing QEMU maliciously since 2020, recent activity is attributed to the Payouts King ransomware group and a cluster of threat actors believed to be initial access brokers who have also been exploiting the CitrixBleed2 vulnerability CVE-2025-5777.

What’s Notable and Unique

Payouts King has been observed deploying QEMU since November and uses the VM to create a reverse SSH backdoor to evade detection and install various tools, including Rclone, Chisel, and BusyBox.

In a separate campaign, threat actors are exploiting CVE-2025-5777, a Citrix NetScaler vulnerability that allows attackers to bypass authentication. Once they’ve gained initial access, the threat actors use QEMU to deploy tools inside the VM, which are then used to steal credentials, identify Kerberos usernames, perform Active Directory reconnaissance, and set up FTP servers for staging or data exfiltration.

Analyst Comments

Threat actors continue to focus their efforts on defense evasion, often leveraging legitimate, easily accessible tools such as QEMU. The continued use of QEMU by multiple threat actors highlights the effectiveness of these tactics and the difficulty in detecting and defending against them. To counter this campaign, organizations should proactively monitor for unauthorized QEMU installations, abnormal scheduled tasks, and port forwarding rules.

Sources

QEMU abused to evade detection and enable ransomware delivery

Article

Apr 28, 2026

Microsoft Teams Continues to be Leveraged in Social Engineering Attacks

Microsoft warns that threat actors are increasingly abusing Microsoft Teams and relying on legitimate tools to gain access and conduct lateral movement within enterprise networks. The threat actors impersonate IT or helpdesk staff to contact employees via cross-tenant chats and trick them into granting remote access for data theft. Microsoft has observed multiple intrusions with a similar attack chain that utilized commercial remote management software, like Quick Assist and the Rclone utility, to transfer files to an external cloud storage service. This tactic, notably associated with Black Basta and Cactus ransomware operations in late 2024 and early 2025, appears to have resurfaced, with similar activity more recently observed in intrusions linked to the Akira and Payouts King ransomware groups.

What’s Notable and Unique

Initial access is achieved by leveraging external collaboration features in Microsoft Teams to allow impersonation of internal support personnel, tricking users into bypassing security warnings. This reflects abuse of legitimate functionality rather than exploitation of a Microsoft Teams vulnerability.
Following initial access, attackers conduct rapid reconnaissance using Command Prompt and PowerShell to assess privileges, domain membership, and opportunities for lateral movement. Persistence is maintained through Windows Registry modifications, after which attackers leveraged WinRM for lateral movement, targeting domain-joined systems and high-value assets, including domain controllers.
Malicious payloads were staged in user-writable directories and executed through DLL side-loading via trusted, signed applications, enabling covert code execution while blending with legitimate activity. Additional remote management tools were also deployed to support broader access, while Rclone or similar utilities were used to stage and exfiltrate sensitive data to external cloud storage.

Analyst Comments

This activity highlights how modern threat actors can leverage trusted collaboration workflows, remote management tools, and stealthy exfiltration techniques to conduct intrusions through a combination of social engineering and misuse of legitimate functionality. Effective defense depends on layered mitigations that combine identity controls, restricted remote administration, endpoint hardening, network protections, and user awareness measures to disrupt attacker activity at multiple stages of the intrusion lifecycle. To mitigate the risk of this and similar campaigns, users should treat external Teams contacts as untrusted by default, and administrators should restrict or closely monitor remote assistance tools while limiting WinRM usage to controlled systems.

Sources

Cross‑tenant helpdesk impersonation to data exfiltration: A human-operated intrusion playbook
Microsoft: Teams increasingly abused in helpdesk impersonation attacks
Payouts King Takes Aim at the Ransomware Throne