Malware Spotlight: RansomHub Ransomware

Report

Malware Spotlight: RansomHub Ransomware

Jan 8, 2025

Arete Analysis

Download The Report

Executive Summary

In 2024, Arete’s Incident Response (IR) team responded to dozens of incidents attributed to the RansomHub threat actor group. Engagements attributed to RansomHub increased rapidly since Arete first observed them in May 2024, and the group quickly established itself as one of the top three threat actor groups since
July 2024.

RansomHub has impacted multiple sectors across Arete engagements, including professional services, public services, healthcare, high technology, financial services, and manufacturing. The group has targeted several high-profile targets since its emergence, including telecom giant Frontier and British auction house Christie’s. RansomHub also claimed to possess data stolen from Change Healthcare, which was the victim of an ALPHV/BlackCat ransomware attack in February 2024. RansomHub announced the sale of Change’s data after leaking some of the alleged data a day beforehand.

Advertisements for the RansomHub Ransomware-as-a-Service (RaaS) appeared on cybercriminal forums on February 2, 2024, highlighting an encryptor developed using the C++ and Go programming languages. The use of Go makes it easier for ransomware groups to target a wide variety of operating systems without needing to rewrite significant portions of the malware, as Go allows developers to compile executables for Windows, Linux, and macOS platforms from a single codebase. These advertisements were accompanied by
a new data leak site (DLS) under the RansomHub branding on the dark web.

RansomHub is suspected to be a re-brand of the “Knight” ransomware group, whose source code was listed for sale on the underground RAMP forum on February 18, 2024. From research, Arete can confirm various similarities between RansomHub and Knight’s encryptors.

This spotlight explores the ransomware group’s observed behavior, background information on the threat actor, and statistics from Incident Response engagements, along with a technical analysis of RansomHub’s ransomware executable. Finally, we discuss security recommendations to better defend against this evolving cyber threat and mitigate the risk of financial and reputational losses.

Incident Response Data on the RansomHub Ransomware Group

The information provided below is based on engagements involving the RansomHub threat actor group 
investigated by Arete in 2024. Our IR, Threat Intelligence, and Data Analytics teams work together 
to analyze key data points during every ransomware engagement and form real-time 
threat actor (TA) insights.
- Targeted sectors include professional services, public services, healthcare, high technology, 
  financial services, and manufacturing.
- The median initial ransom demand is $900,000.
- The median ransom payment facilitated is $350,000.
- Tools and malware observed during investigations include SocGholish, CobaltStrike, Mimikatz, 
  Rclone, Filezilla, WinSCP, PsExec, AnyDesk, PuTTY, WinSCP, Rclone, SoftPerfect Network Scanner, 
  and TDSSKiller and EDRKillShifter to disable EDR software to evade detection.
- RansomHub-affiliated actors have exploited vulnerabilities in a variety of technologies, 
  including Apache ActiveMQ, Atlassian Confluence, Citrix ADC, F5 BIG-IP, and Fortinet FortiOS.
- The group operates a data leak site (DLS) self-proclaimed as “RansomHub” and commonly threatens 
  victims with releasing stolen data as a pressure tactic if a payment is not made.
- The file extension appended to encrypted files is created based on the first six characters of 
  the Curve 25519 public key, and files are encrypted using a decrypted Curve 25519 public key and 
  AES algorithms.
- The ransom note created self-identifies the group as RansomHub and references their data leak 
  and chat negotiation sites. The filename of the ransom note is dependent on the encrypted file 
  extension as a naming convention and follows this format: “README_.txt”. For example: README_11f5ew.txt.
- In addition to encrypting files and creating a ransom note, the RansomHub ransomware needs a 
  password to properly execute, supports various command line arguments, deletes volume shadow 
  copies, clears the Windows Event Logs, and tries to stop virtual machines (VMs)

The information provided below is based on engagements involving the RansomHub threat actor group 
investigated by Arete in 2024. Our IR, Threat Intelligence, and Data Analytics teams work together 
to analyze key data points during every ransomware engagement and form real-time 
threat actor (TA) insights.
- Targeted sectors include professional services, public services, healthcare, high technology, 
  financial services, and manufacturing.
- The median initial ransom demand is $900,000.
- The median ransom payment facilitated is $350,000.
- Tools and malware observed during investigations include SocGholish, CobaltStrike, Mimikatz, 
  Rclone, Filezilla, WinSCP, PsExec, AnyDesk, PuTTY, WinSCP, Rclone, SoftPerfect Network Scanner, 
  and TDSSKiller and EDRKillShifter to disable EDR software to evade detection.
- RansomHub-affiliated actors have exploited vulnerabilities in a variety of technologies, 
  including Apache ActiveMQ, Atlassian Confluence, Citrix ADC, F5 BIG-IP, and Fortinet FortiOS.
- The group operates a data leak site (DLS) self-proclaimed as “RansomHub” and commonly threatens 
  victims with releasing stolen data as a pressure tactic if a payment is not made.
- The file extension appended to encrypted files is created based on the first six characters of 
  the Curve 25519 public key, and files are encrypted using a decrypted Curve 25519 public key and 
  AES algorithms.
- The ransom note created self-identifies the group as RansomHub and references their data leak 
  and chat negotiation sites. The filename of the ransom note is dependent on the encrypted file 
  extension as a naming convention and follows this format: “README_.txt”. For example: README_11f5ew.txt.
- In addition to encrypting files and creating a ransom note, the RansomHub ransomware needs a 
  password to properly execute, supports various command line arguments, deletes volume shadow 
  copies, clears the Windows Event Logs, and tries to stop virtual machines (VMs)

The information provided below is based on engagements involving the RansomHub threat actor group 
investigated by Arete in 2024. Our IR, Threat Intelligence, and Data Analytics teams work together 
to analyze key data points during every ransomware engagement and form real-time 
threat actor (TA) insights.
- Targeted sectors include professional services, public services, healthcare, high technology, 
  financial services, and manufacturing.
- The median initial ransom demand is $900,000.
- The median ransom payment facilitated is $350,000.
- Tools and malware observed during investigations include SocGholish, CobaltStrike, Mimikatz, 
  Rclone, Filezilla, WinSCP, PsExec, AnyDesk, PuTTY, WinSCP, Rclone, SoftPerfect Network Scanner, 
  and TDSSKiller and EDRKillShifter to disable EDR software to evade detection.
- RansomHub-affiliated actors have exploited vulnerabilities in a variety of technologies, 
  including Apache ActiveMQ, Atlassian Confluence, Citrix ADC, F5 BIG-IP, and Fortinet FortiOS.
- The group operates a data leak site (DLS) self-proclaimed as “RansomHub” and commonly threatens 
  victims with releasing stolen data as a pressure tactic if a payment is not made.
- The file extension appended to encrypted files is created based on the first six characters of 
  the Curve 25519 public key, and files are encrypted using a decrypted Curve 25519 public key and 
  AES algorithms.
- The ransom note created self-identifies the group as RansomHub and references their data leak 
  and chat negotiation sites. The filename of the ransom note is dependent on the encrypted file 
  extension as a naming convention and follows this format: “README_.txt”. For example: README_11f5ew.txt.
- In addition to encrypting files and creating a ransom note, the RansomHub ransomware needs a 
  password to properly execute, supports various command line arguments, deletes volume shadow 
  copies, clears the Windows Event Logs, and tries to stop virtual machines (VMs)

Background

RansomHub became a notable ransomware operation in 2024, and, alongside Akira, represented a verysignificant percentage of Arete Incident Response engagements in Q3 of 2024.

Source: Arete's Q3 2024 Crimeware Report

The group utilizes both Windows and Linux variants of encryptors, which increases its operational capability to target a wide range of victims of various sectors and sizes. RansomHub operates under a double extortion model, which involves exfiltrating sensitive data and encrypting the victims’ systems to coerce a payment for
a decryptor and data deletion.

Technical Analysis

Malware analysis revealed that RansomHub ransomware:

Supports multiple command-line arguments.
Requires a password to properly execute and encrypt files.
Encrypts files on the system and mounted shares.
Creates a ransom note with the following filename: .README_.txt
Self-identifies the group as RansomHub in the ransom note.
References a data leak site in the ransom note that, when accessed, self-identifies the group as RansomHub.
Kills a list of processes and services.
Maintains a list of whitelisted files and directories to make sure it will not render the system unusable, preventing recovery when running a decryptor.
Attempts to prevent system recovery by deleting the system’s volume shadow copies.
Clears the Windows event logs.
Creates a desktop wallpaper image in the “%temp%\” directory and later modifies a registry key to change desktop wallpaper.

Execution Pattern/Arguments

The RansomHub ransomware needs command line arguments to execute and encrypt files in the system.

Command line arguments supported:

Command line arguments	Description
-cmd	CMD to be executed before encryption.
-disable-net	Disable network before running.
-fast value	Fast encryption mode.
-file value	Only process file inside defined files. For example, -file C://1.txt, -file D://2.txt.
-host value	Only process net share inside defined hosts. -host 10.10.10.10 -host 10.10.10.11.
-only-local	Only encrypt local disks.
-pass [SHA256 string]	Password needed to execute the ransomware. A 64-character string.
-path value	Only process files inside defined paths. -path C:// -path D:// -path //10.10.10.10/d/
-safeboot	Reboot in Safe Mode before running.
-safeboot-instance	Run as Safe Mode instance.
-skip-vm value	Skip shutting down VMs. Example: -skip-vm “Ubuntu 22.04 LTS”, -skip-vm “Windows Server 2012”.
-sleep [integer value]	Sleep for a period of time to run (minute).
-verbose	Log to console.

Ransomware execution with the command line argument –help:

Figure 1. Command line arguments supported by the ransomware

The ransomware will not execute in the system without the “-pass” argument followed by a SHA-256 value that is unique in each engagement. Execution of ransomware to encrypt files:

RansomHub.exe -pass [SHA-256]

Example:
RansomHub.exe -pass

7ac8cd689f5d9f4c1ddca14ec84965ed42b17343ebe086076ba0e7a46a80f81f

Once the SHA-256 password value is provided, the ransomware will decrypt a JSON based ransomware configuration at the run time.

Decrypted JSON field name and descriptions:

Name	Description
master_public_key	Curve25519 public key used in the file encryption process.
extension	Extension added to encrypted files.
note_file_name	Ransom note file name, default value is .README<encrypted_file_extension>.txt
note_full_text	Ransom note content.
settings	Ransomware operation setting. Example: { “local_disks”: true, “network_shares”: true, “kill_processes”: true, “kill_services”: true, “set_wallpaper”: true, “net_spread”: true, “self_delete”: false, “running_one”: true }
credentials	Contains common or locally stolen credentials which are used for propagation and further infection.
kill_services	Terminates list of services.
kill_processes	Terminates list of processes.
white_folders	Excludes listed directories.
white_files	Excludes listed files.
white_hosts	Excludes listed hosts.

Stop Services and Processes

Before file encryption, the ransomware terminates a pre-determined list of processes and services to encrypt as many files as possible.

Process names:

“agntsvc.exe”, “dbeng50.exe”, “dbsnmp.exe”, “encsvc.exe”, “excel.exe”, “firefox.exe”, “infopath.exe”, “isqlplussvc.exe”, “msaccess.exe”, “mspub.exe”, “mydesktopqos.exe”, “mydesktopservice.exe”, “notepad.exe”, “ocautoupds.exe”, “ocomm.exe”, “ocssd.exe”, “onenote.exe”, “oracle.exe”, “outlook.exe”, “powerpnt.exe”, “sqbcoreservice.exe”, “sql.exe”, “steam.exe”, “synctime.exe”, “tbirdconfig.exe”, “thebat.exe”, “thunderbird.exe”, “visio.exe”, “winword.exe”, “wordpad.exe”, “xfssvccon.exe”, “sql.exe”, “bedbh.exe”, “vxmon.exe”, “benetns.exe”, “bengien.exe”, “pvlsvr.exe”, “beserver.exe”, “raw_agent_svc.exe”, “vsnapvss.exe”, “CagService.exe”, “QBIDPService.exe”, “QBDBMgrN.exe”, “QBCFMonitorService.exe”, “SAP.exe”, “TeamViewer_Service.exe”, “TeamViewer.exe”, “tv_w32.exe”, “tv_x64.exe”, “CVMountd.exe”, “cvd.exe”, “cvfwd.exe”, “CVODS.exe”, “saphostexec.exe”, “saposcol.exe”, “sapstartsrv.exe”, “avagent.exe”, “avscc.exe”, “DellSystemDetect.exe”, “EnterpriseClient.exe”, “VeeamNFSSvc.exe”, “VeeamTransportSvc.exe”, “VeeamDeploymentSvc.exe”

Services names:

“mepocs”, “memtas”, “veeam”, “svc$”, “backup”, “sql”, “vss”, “sql$”, “mysql”, “mysql$”, “sophos”, “MSExchange”, “MSExchange$”, “WSBExchange”, “PDVFSService”, “BackupExecVSSProvider”, “BackupExecAgentAccelerator”, “BackupExecAgentBrowser”, “BackupExecDiveciMediaService”, “BackupExecJobEngine”, “BackupExecManagementService”, “BackupExecRPCService”, “GxBlr”, “GxVss”, “GxClMgrS”, “GxCVD”, “GxCIMgr”, “GXMMM”, “GxVssHWProv”, “GxFWD”, “SAPService”, “SAP”, “SAP$”, “SAPD$”, “SAPHostControl”, “SAPHostExec”, “QBCFMonitorService”, “QBDBMgrN”, “QBIDPService”, “AcronisAgent”, “VeeamNFSSvc”, “VeeamDeploymentService”, “VeeamTransportSvc”, “MVArmor”, “MVarmor64”, “VSNAPVSS”, “AcrSch2Svc”

The ransomware also tries to list and stop VMs by executing the following PowerShell command.

powershell.exe -Command PowerShell -Command “{ Get-VM \| Stop-VM -Force }”
powershell.exe Get-VM \| Stop-VM -Force -inputFormat xml -outputFormat text

File and Directory Exclusions

The ransomware excludes system-related files and folders, ransomware-related files, and whitelisted extensions during encryption.

Excluded file and extensions:

“NTUSER.DAT”, “autorun.inf”, “boot.ini”, “desktop.ini”, “thumbs.db”, “.deskthemepack”, “.themepack”, “.theme”, “.msstyles”, “.exe”, “.drv”, “.msc”, “.dll”, “.lock”, “.sys”, “.msu”, “.lnk”, “.ps1”, “.iso”, “.inf”, “.cab”, “*.386”

Excluded directories:

“\\$windows.~ws”, “\\$windows.~bt”, “\\windows\\”, “\\windows.old”, “\\system volume information”, “\\Boot”, “\\PerfLogs”, “\\AppData\\Local\\Temp”, “\\AppData\\Local\\Microsoft\\GameDVR”, “\\ AppData\\Local\\Microsoft\\Edge”, “\\AppData\\Local\\Packages\\Microsoft.”, “\\AppData\\Local\\Packages\\ MicrosoftWindows.”, “\\AppData\\Local\\Packages\\Internet Explorer”, “\\Program Files\\Common Files\\microsoft shared”, “\\Program Files\\Common Files\\Services”, “\\Program Files\\Common Files\\System”, “\\Program Files\\Internet Explorer”, “\\Program Files\\ModifiableWindowsApps”, “\\Program Files\\Uninstall Information”, “\\Program Files\\Windows Defender”, “\\Program Files\\Windows Mail”, “\\Program Files\\Windows Media Player”, “\\Program Files\\Windows NT”, “\\Program Files\\Windows Photo Viewer”, “\\Program Files\\Windows Portable Devices”, “\\Program Files\\Windows Security”, “\\Program Files\\Windows Sidebar”, “\\Program Files\\ WindowsApps”, “\\Program Files\\WindowsPowerShell”, “\\Program Files (x86)\\Common Files”, “\\Program Files (x86)\\Common Files\\Microsoft Shared”, “\\Program Files (x86)\\Common Files\\Services”, “\\Program Files (x86)\\ Common Files\\System”, “\\Program Files (x86)\\Internet Explorer”, “\\Program Files (x86)\\Microsoft\\Edge”, “\\Program Files (x86)\\Microsoft\\Temp”, “\\Program Files (x86)\\Microsoft.NET”, “\\Program Files (x86)\\ Windows Defender”, “\\Program Files (x86)\\Windows Mail”, “\\Program Files (x86)\\Windows Media Player”, “\\Program Files (x86)\\Windows Multimedia Platform”, “\\Program Files (x86)\\Windows NT”, “\\Program Files (x86)\\Windows Photo Viewer”, “\\Program Files (x86)\\Windows Portable Devices”, “\\Program Files (x86)\\ Windows Security”, “\\Program Files (x86)\\Windows Sidebar”, “\\Program Files (x86)\\WindowsPowerShell”, “\\ ProgramData\\ssh\\”, “\\ProgramData\\USOPrivate”, “\\ProgramData\\USOShared”, “\\ProgramData\\Package Cache”, “\\ProgramData\\Microsoft\\Device Stage”, “\\ProgramData\\Microsoft\\DeviceSync”, “\\ProgramData\\ Microsoft\\Diagnosis”, “\\ProgramData\\Microsoft\\DiagnosticLogCSP”, “\\ProgramData\\Microsoft\\DRM”, “\\ ProgramData\\Microsoft\\UEV”, “\\ProgramData\\Microsoft\\EdgeUpdate”, “\\ProgramData\\Microsoft\\Event Viewer”, “\\ProgramData\\Microsoft\\IdentityCRL”, “\\ProgramData\\Microsoft\\MapData”, “\\ProgramData\\ Microsoft\\MF”, “\\ProgramData\\Microsoft\\NetFramework”, “\\ProgramData\\Microsoft\\Network”, “\\ ProgramData\\Microsoft\\Provisioning”, “\\ProgramData\\Microsoft\\Search”, “\\ProgramData\\Microsoft\\ SmsRouter”, “\\ProgramData\\Microsoft\\Spectrum”, “\\ProgramData\\Microsoft\\Speech_OneCore”, “\\ ProgramData\\Microsoft\\Storage Health”, “\\ProgramData\\Microsoft\\User Account Pictures”, “\\ProgramData\\ Microsoft\\Vault”, “\\ProgramData\\Microsoft\\WDF”, “\\ProgramData\\Microsoft\\Windows”, “\\ProgramData\\ Microsoft\\Windows Defender”, “\\ProgramData\\Microsoft\\Windows NT”, “\\ProgramData\\Microsoft\\ Windows Security Health”, “\\ProgramData\\Microsoft\\WinMSIPC”, “\\ProgramData\\Microsoft\\WPD”, “\\ ProgramData\\Packages\\USOPrivate”, “\\ProgramData\\Packages\\USOShared”, “\\ProgramData\\Packages\\ WindowsHolographicDevices”, “\\ProgramData\\Packages\\MicrosoftWindows.”, “\\ProgramData\\Packages\\ Microsoft.”

Inhibit System Recovery

Windows operating systems contain features that can help fix corrupted system files, including shadow copies, which are backups of files created by the Volume Shadow Copy Service (VSS). By deleting shadow copies, the ransomware can prevent victims from restoring files from backups, making it more difficult for them to recover their data without paying the ransom.

The ransomware deletes volume shadow copies before file encryption by starting the following process:

powershell.exe -Command PowerShell -Command “\”Get-CimInstance Win32_ShadowCopy \| Remove-CimInstance\””

System Network Connections Discovery

The ransomware can enumerate network-mounted shares by scanning the network interfaces.

Data Encrypted for Impact

The ransomware initially finds available drives, then loads the files one by one using the Windows API “FindFirstFileW“ and “FindNextFileW”. The ransomware generates random keys to encrypt the files, and after encrypting them, the keys are encrypted using a public key. To encrypt files, the ransomware uses a combination of a decrypted Curve 25519 public key and AES algorithms.

The default extension value is the first six characters of the Curve 25519 public key.

Figure 2. Extension added to the encrypted files

Files smaller than 0x100000 bytes are completely encrypted. If the file size is larger than 0x100000 bytes, the ransomware encrypts the file in 0x100000 bytes blocks and skips every 0x200000 bytes of data in between encrypted chunks.

Figure 3. 0x100000 bytes encrypted file.

Upon successful execution, the ransomware creates ransom notes with the file name “README_[encrypted_file_extension].txt”

Figure 4. RansomHub ransom note

Ransom note content:

We are the RansomHub.

Your company Servers are locked and Data has been taken to our servers. This is serious.

Good news:
– your server system and data will be restored by our Decryption Tool, we support trial decryption to prove that your files can be decrypted;
– for now, your data is secured and safely stored on our server;
– nobody in the world is aware about the data leak from your company except you and RansomHub team;
– we provide free trial decryption for files smaller than 1MB. If anyone claims they can decrypt our files, you can ask them to try to decrypt a file larger than 1MB.

FAQs:
Who we are?
– Normal Browser Links: https://ransomxifxwc5eteopdobynonjctkxxvap77yqifu2emfbecgbqdw6qd[.]onion.ly/
– Tor Browser Links: http://ransomxifxwc5eteopdobynonjctkxxvap77yqifu2emfbecgbqdw6qd[.]onion/

Want to go to authorities for protection?
– Seeking their help will only make the situation worse,They will try to prevent you from negotiating with us, because the negotiations will make them look incompetent,After the incident report is handed over to the government
department, you will be fined <This will be a huge amount,Read more about the GDRP legislation: https://en.wikipedia.org/wiki/General_Data_Protection_Regulation>, The government uses your fine to reward them.And you will not get anything, and except you and your company, the rest of the people will forget what happened!!!!!

Think you can handle it without us by decrypting your servers and data using some IT Solution from third-party “specialists”?
– they will only make significant damage to all of your data; every encrypted file will be corrupted forever. Only our Decryption Tool will make decryption guaranteed;

Don’t go to recovery companies, they are essentially just middlemen who will make money off you and cheat you.
– We are well aware of cases where recovery companies tell you that the ransom price is 5 million dollars, but in fact they secretly negotiate with us for 1 million dollars, so they earn 4 million dollars from you. If you approached us directly without intermediaries you would pay 5 times less, that is 1 million dollars.

Think your partner IT Recovery Company will do files restoration?
– no they will not do restoration, only take 3-4 weeks for nothing; besides all of your data is on our servers and we can publish it at any time; as well as send the info about the data breach from your company servers to your key partners and clients,
competitors, media and youtubers, etc. Those actions from our side towards your company will have irreversible negative consequences for your business
reputation.

You don’t care in any case, because you just don’t want to pay?
– We will make you business stop forever by using all of our experience to make your partners, clients, employees and whoever cooperates with your company change their minds by having no choice but to stay away from your company.
As a result, in midterm you will have to close your business.

So lets get straight to the point.

What do we offer in exchange on your payment:
– decryption and restoration of all your systems and data within 24 hours with guarantee;
– never inform anyone about the data breach out from your company;
– after data decryption and system restoration, we will delete all of your data from our servers forever;
– provide valuable advising on your company IT protection so no one can attack your again.

Now, in order to start negotiations, you need to do the following:
– install and run ‘Tor Browser’ from https://www.torproject.org/download/
– use ‘Tor Browser’ open <TA_URL_removed_by_analyst>.onion/
– enter your Client ID: <ID_removed_by_analyst>
* do not leak your ID or you will be banned and will never be able to decrypt your files.

There will be no bad news for your company after successful negotiations for both sides. But there will be plenty of those bad news if case of failed negotiations, so don’t think about how to avoid it. Just focus on negotiations, payment and decryption to make all of your problems solved by our specialists within 1
day after payment received: servers and data restored, everything will work good as new.

************************************************

Modify Registry

The ransomware performs a registry key modification to change the desktop wallpaper.

Registry key change:

Registry key	Value name	Value data
Computer\HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\ CurrentVersion\Explorer\Wallpapers	BackgroundHistory Path0	C:\Users\%USERNAME%\ AppData\Local\Temp\MkgXoB.png

Registry key

Value name

Value data

Computer\HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\

CurrentVersion\Explorer\Wallpapers

BackgroundHistory
Path0

C:\Users\%USERNAME%\
AppData\Local\Temp\MkgXoB.png

Screenshot showing the registry key modification:

Wallpaper image content from the
C:\Users\%USERNAME%\AppData\Local\Temp\MkgXoB.png file:

Mutex

The mutex is the fundamental tool for managing shared resources between multiple threads or processes. Typically, ransomware uses a mutex to avoid reinfecting the victim system and causing multiple layers of encryption. The ransomware did not create a mutex during execution.

Network Activity

The ransomware did not try to communicate with a remote server other than encrypting data from mounted shares.

Indicator Removal

The ransomware clears Windows Event Logs to hide its malicious activity. Windows Event Logs keep a record of a computer’s alerts and notifications. The ransomware runs the following commands to clear the logs:

cmd.exe /c wevtutil cl security cmd.exe /c wevtutil cl system cmd.exe /c wevtutil cl application

File and Directory Permissions Modification

The ransomware uses the fsutil tool to redirect file system access to a different location after gaining access to a compromised network. The ransomware uses the following command line to redirect file system access, enabling remote to remote and remote to local symbolic links:

fsutil behavior set SymlinkEvaluation R2L:1 fsutil behavior set SymlinkEvaluation R2R:1

Indicators of Compromise

Indicator	Type	Context
de7913504efe4584bdd9dd1ec13c4de4152a84df5e1cb-c31d0dd8fe70c88b5e0 4ac0e6c804f638182ee8e23c37e0c474a22f8bc2b3eed5ac-c0a56764839e4106 83654c500c68418142e43b31ebbec040d9d36cfbbe08c7b9b-3dc90fabc14801a eaee06cb53ff473f32d02ad1aca38957812b394f69dd0a3d2af-16f2d923b10e3	SHA256 hash	RansomHub ransomware
README_<encrypted_file_extension>.txt	File name	RansomHub ransom note
powershell.exe -Command PowerShell -Command “{ Get-VM \| Stop-VM -Force }”	Process	Retrieve information about VMs and forces a shutdown
powershell.exe -Command PowerShell -Command ” \\”Get-CimInstance Win32_ShadowCopy \| Remove-CimInstance\\”” cmd.exe /c “\\”vssadmin.exe Delete Shadows /all /quiet\\””	Process	Volume Shadow Copy deletion
cmd.exe /c wevtutil cl security cmd.exe /c wevtutil cl system cmd.exe /c wevtutil cl application	Process	Clearing Windows Event Logs
cmd.exe /c “\\”fsutil behavior set SymlinkEvaluation R2L:1\\”” cmd.exe /c “\\”fsutil behavior set SymlinkEvaluation R2R:1\\””	Process	Enable remote to remote and remote to local symbolic links
Key: Computer\HKEY_CURRENT_USER\SOFTWARE\Microsoft\ Windows\CurrentVersion\Explorer\Wallpapers Value: BackgroundHistoryPath0 Data: C:\Users\%USERNAME%\AppData\Local\Temp\MkgXoB. png	Registry	Desktop wallpaper modification
ransomxifxwc5eteopdobynonjctkxxvap77yqifu2emfbecgbqdw6qd[.] onion	URL	TA data leak site (DLS)

Ransomware Configuration

RansomHub decrypted configuration information extracted:

{"master_public_key": <public_key_removed_by_analyst> "extension": 
"<extension_removed_by_analyst>" "note_file_name": 
"README_<extension_removed_by_analyst>.txt", "note_full_text": "We are the RansomHub.
\n\nYour company Servers are locked and Data has been taken to our servers. This is serious. 
\n\nGood news:\n- your server system and data will be restored by our Decryption Tool, we supply 
trial decryption to prove that your files can be decrypted;\n- for now, your data is secured and
safely stored on our server;\n- nobody in the world is aware about the data leak from your company 
except you and RansomHub team;\n- we provide free trial decryption for files smaller than 1MB. If 
anyone claims they can decrypt our files, you can ask them to try to decrypt a file larger than 
1MB.\n\nFAQs:\nWho we are?\n- Normal Browser Links: https://ransomxifxwc5eteopdobynonjctkxvap77yqifu2emfbecbqdw6qd.onion.ly/\n- 
Tor Browser 
Links: 
http://ransomxifxwc5eteopdobynonjctkxvap77yqifu2emfbecbqdw6qd.onion/\n\nWant to go to authorities 
for protection?\n- Seeking their help will only make the situation worse,They will try to prevent 
you from negotiating with us, because the negotiations will make them look incompetent,After the 
incident report is handed over to the government department, you will be fined 
<This will be a huge amount,Read more about the GDRP legislation:https://
en.wikipedia.org/wiki/General_Data_Protection_Regulation> The government uses your fine to reward 
them.And you will not get anything, and except you and your company, the rest of the people will 
forget what happened!!!!!\n\nThink you can handle it without us by decrypting your servers and 
data using some IT Solution from third-party \"specialists\"?\n- they will only make significant 
damage to all of your data; every encrypted file will be corrupted forever. Only our Decryption 
Tool will make decryption guaranteed;\nDon't go to recovery companies, they are essentially just 
middlemen who will make money off you and cheat you. \n- We are well aware of cases where recovery 
companies tell you that the ransom price is 5 million dollars, but in fact they secretly negotiate 
with us for 1 million dollars, so they earn 4 million dollars from you. If you approached us 
directly without intermediaries you would pay 5 times less, that is 1 million dollars.\n\nThink 
your partner IT Recovery Company will do files restoration?\n- no they will not do restoration, 
only take 3-4 weeks for nothing; besides all of your data is on our server and we can publish it 
at any time; \n as well as send the info about the data breach from your company servers to your 
key partners and clients, competitors, media and youtubers, etc. \n Those actions from our side 
towards your company will have irreversible negative consequences for your business reputation.
\n\nYou don't care in any case, because you just don't want to pay? \n- We will make you business 
stop forever by using all of our experience to make your partners, clients, employees and whoever 
cooperates with your company change their minds by having no choice but to stay away from your 
company. \nAs a result, in midterm you will have to close your business. \n\nSo lets get straight 
to the point.\n\nWhat do we offer in exchange on your payment:\n- decryption and restoration of all 
your systems and data within 24 hours with guarantee;\n- never inform anyone about the data breach 
out from your company;\n- after data decryption and system restoration, we will delete all of your 
data from our servers forever;\n- provide valuable advising on your company IT protection so no 
one can hack you again.\n\nNow, in order to start negotiations, you need to do the following:\n- 
install and run 'Tor Browser' from https://www.torproject.org/download/\n- use 'Tor Browser' 
open <TA_URL_removed_by_analyst> \n- enter your ID or you will be banned and will never be able to 
decrypt your files.\n\nThere will be live chat for your company after successful negotiations for 
both sides. But there will be plenty of those bad cases of failed negotiations, so don't think about 
how to avoid it.\nJust focus on negotiations, payment and describe to make all of your problems 
solved by our specialists within 1 day after payment received: servers and data restored, 
everything will work good as new.\n\n************************************************\n",
"note_short_text": "Your data is stolen and encrypted, see README_<extension_removed_by_analyst>.txt.", "settings": 
  {"local_disks"

{"master_public_key": <public_key_removed_by_analyst> "extension": 
"<extension_removed_by_analyst>" "note_file_name": 
"README_<extension_removed_by_analyst>.txt", "note_full_text": "We are the RansomHub.
\n\nYour company Servers are locked and Data has been taken to our servers. This is serious. 
\n\nGood news:\n- your server system and data will be restored by our Decryption Tool, we supply 
trial decryption to prove that your files can be decrypted;\n- for now, your data is secured and
safely stored on our server;\n- nobody in the world is aware about the data leak from your company 
except you and RansomHub team;\n- we provide free trial decryption for files smaller than 1MB. If 
anyone claims they can decrypt our files, you can ask them to try to decrypt a file larger than 
1MB.\n\nFAQs:\nWho we are?\n- Normal Browser Links: https://ransomxifxwc5eteopdobynonjctkxvap77yqifu2emfbecbqdw6qd.onion.ly/\n- 
Tor Browser 
Links: 
http://ransomxifxwc5eteopdobynonjctkxvap77yqifu2emfbecbqdw6qd.onion/\n\nWant to go to authorities 
for protection?\n- Seeking their help will only make the situation worse,They will try to prevent 
you from negotiating with us, because the negotiations will make them look incompetent,After the 
incident report is handed over to the government department, you will be fined 
<This will be a huge amount,Read more about the GDRP legislation:https://
en.wikipedia.org/wiki/General_Data_Protection_Regulation> The government uses your fine to reward 
them.And you will not get anything, and except you and your company, the rest of the people will 
forget what happened!!!!!\n\nThink you can handle it without us by decrypting your servers and 
data using some IT Solution from third-party \"specialists\"?\n- they will only make significant 
damage to all of your data; every encrypted file will be corrupted forever. Only our Decryption 
Tool will make decryption guaranteed;\nDon't go to recovery companies, they are essentially just 
middlemen who will make money off you and cheat you. \n- We are well aware of cases where recovery 
companies tell you that the ransom price is 5 million dollars, but in fact they secretly negotiate 
with us for 1 million dollars, so they earn 4 million dollars from you. If you approached us 
directly without intermediaries you would pay 5 times less, that is 1 million dollars.\n\nThink 
your partner IT Recovery Company will do files restoration?\n- no they will not do restoration, 
only take 3-4 weeks for nothing; besides all of your data is on our server and we can publish it 
at any time; \n as well as send the info about the data breach from your company servers to your 
key partners and clients, competitors, media and youtubers, etc. \n Those actions from our side 
towards your company will have irreversible negative consequences for your business reputation.
\n\nYou don't care in any case, because you just don't want to pay? \n- We will make you business 
stop forever by using all of our experience to make your partners, clients, employees and whoever 
cooperates with your company change their minds by having no choice but to stay away from your 
company. \nAs a result, in midterm you will have to close your business. \n\nSo lets get straight 
to the point.\n\nWhat do we offer in exchange on your payment:\n- decryption and restoration of all 
your systems and data within 24 hours with guarantee;\n- never inform anyone about the data breach 
out from your company;\n- after data decryption and system restoration, we will delete all of your 
data from our servers forever;\n- provide valuable advising on your company IT protection so no 
one can hack you again.\n\nNow, in order to start negotiations, you need to do the following:\n- 
install and run 'Tor Browser' from https://www.torproject.org/download/\n- use 'Tor Browser' 
open <TA_URL_removed_by_analyst> \n- enter your ID or you will be banned and will never be able to 
decrypt your files.\n\nThere will be live chat for your company after successful negotiations for 
both sides. But there will be plenty of those bad cases of failed negotiations, so don't think about 
how to avoid it.\nJust focus on negotiations, payment and describe to make all of your problems 
solved by our specialists within 1 day after payment received: servers and data restored, 
everything will work good as new.\n\n************************************************\n",
"note_short_text": "Your data is stolen and encrypted, see README_<extension_removed_by_analyst>.txt.", "settings": 
  {"local_disks"

{"master_public_key": <public_key_removed_by_analyst> "extension": 
"<extension_removed_by_analyst>" "note_file_name": 
"README_<extension_removed_by_analyst>.txt", "note_full_text": "We are the RansomHub.
\n\nYour company Servers are locked and Data has been taken to our servers. This is serious. 
\n\nGood news:\n- your server system and data will be restored by our Decryption Tool, we supply 
trial decryption to prove that your files can be decrypted;\n- for now, your data is secured and
safely stored on our server;\n- nobody in the world is aware about the data leak from your company 
except you and RansomHub team;\n- we provide free trial decryption for files smaller than 1MB. If 
anyone claims they can decrypt our files, you can ask them to try to decrypt a file larger than 
1MB.\n\nFAQs:\nWho we are?\n- Normal Browser Links: https://ransomxifxwc5eteopdobynonjctkxvap77yqifu2emfbecbqdw6qd.onion.ly/\n- 
Tor Browser 
Links: 
http://ransomxifxwc5eteopdobynonjctkxvap77yqifu2emfbecbqdw6qd.onion/\n\nWant to go to authorities 
for protection?\n- Seeking their help will only make the situation worse,They will try to prevent 
you from negotiating with us, because the negotiations will make them look incompetent,After the 
incident report is handed over to the government department, you will be fined 
<This will be a huge amount,Read more about the GDRP legislation:https://
en.wikipedia.org/wiki/General_Data_Protection_Regulation> The government uses your fine to reward 
them.And you will not get anything, and except you and your company, the rest of the people will 
forget what happened!!!!!\n\nThink you can handle it without us by decrypting your servers and 
data using some IT Solution from third-party \"specialists\"?\n- they will only make significant 
damage to all of your data; every encrypted file will be corrupted forever. Only our Decryption 
Tool will make decryption guaranteed;\nDon't go to recovery companies, they are essentially just 
middlemen who will make money off you and cheat you. \n- We are well aware of cases where recovery 
companies tell you that the ransom price is 5 million dollars, but in fact they secretly negotiate 
with us for 1 million dollars, so they earn 4 million dollars from you. If you approached us 
directly without intermediaries you would pay 5 times less, that is 1 million dollars.\n\nThink 
your partner IT Recovery Company will do files restoration?\n- no they will not do restoration, 
only take 3-4 weeks for nothing; besides all of your data is on our server and we can publish it 
at any time; \n as well as send the info about the data breach from your company servers to your 
key partners and clients, competitors, media and youtubers, etc. \n Those actions from our side 
towards your company will have irreversible negative consequences for your business reputation.
\n\nYou don't care in any case, because you just don't want to pay? \n- We will make you business 
stop forever by using all of our experience to make your partners, clients, employees and whoever 
cooperates with your company change their minds by having no choice but to stay away from your 
company. \nAs a result, in midterm you will have to close your business. \n\nSo lets get straight 
to the point.\n\nWhat do we offer in exchange on your payment:\n- decryption and restoration of all 
your systems and data within 24 hours with guarantee;\n- never inform anyone about the data breach 
out from your company;\n- after data decryption and system restoration, we will delete all of your 
data from our servers forever;\n- provide valuable advising on your company IT protection so no 
one can hack you again.\n\nNow, in order to start negotiations, you need to do the following:\n- 
install and run 'Tor Browser' from https://www.torproject.org/download/\n- use 'Tor Browser' 
open <TA_URL_removed_by_analyst> \n- enter your ID or you will be banned and will never be able to 
decrypt your files.\n\nThere will be live chat for your company after successful negotiations for 
both sides. But there will be plenty of those bad cases of failed negotiations, so don't think about 
how to avoid it.\nJust focus on negotiations, payment and describe to make all of your problems 
solved by our specialists within 1 day after payment received: servers and data restored, 
everything will work good as new.\n\n************************************************\n",
"note_short_text": "Your data is stolen and encrypted, see README_<extension_removed_by_analyst>.txt.", "settings": 
  {"local_disks"

Data Leak Site

The RansomHub ransom note contains a data leak site (DLS) that displayed the following page, self-identifying the group as RansomHub:

Figure 5. TOR DLS

Similarities with Other Ransomware

During our analysis, we observed some similarities between RansomHub, ALPHV/BlackCat, and Knight ransomware executables.

The following table highlights some of the similarities:

Malware Family	Common Arguments	Password	JSON Configuration
RansomHub	pass safeboot safeboot-instance path help verbose fast path sleep	SHA256 strings value	extension note_file_name note_full_text note_short_text kill_processes kill_services credentials
ALPHV/BlackCat	–access-token (similar to -pass in RansomHub and Knight) safeboot safeboot-instance paths help verbose	SHA256 strings value	extension note_file_name note_full_text note_short_text kill_processes kill_services credentials
Knight	pass path verbose fast path sleep	SHA256 strings value	extension note_file_name note_full_text note_short_text kill_processes kill_services credentials

Detection Mechanisms

Custom Detections and Blocking with Arete Bloktd℠

SentinelOne S1QL 1.0 query syntax (STAR rule):

RansomHub Ransomware

EndpointOS = "windows" AND EventType = "Process Creation" AND TgtProcCmdLine RegExp 
"\.exe\s{1,3}[A-Za-z0-9-]{0,20}\s{0,3}-pass\s[A-Za-z0-9]{64}"

Volume Shadow Copy Deletion

EndpointOS = "windows" AND EventType = "Process Creation" AND TgtProcCmdLine Contains 
Anycase "powershell.exe" AND TgtProcCmdLine Contains Anycase "-Command" AND TgtProcCmdLine 
Contains Anycase "Get-CimInstance" AND TgtProcCmdLine Contains Anycase "Win32_ShadowCopy"

Windows Event Log Cleared 

EndpointOS = "windows" AND ObjectType = "process" AND TgtProcCmdLine Contains Anycase 
"wevtutil" AND TgtProcCmdLine Contains Anycase " cl " AND TgtProcCmdLine In Contains 
Anycase ("Application", "Security", "System")

SentinelOne S1QL 1.0 query syntax (STAR rule):

RansomHub Ransomware

EndpointOS = "windows" AND EventType = "Process Creation" AND TgtProcCmdLine RegExp 
"\.exe\s{1,3}[A-Za-z0-9-]{0,20}\s{0,3}-pass\s[A-Za-z0-9]{64}"

Volume Shadow Copy Deletion

EndpointOS = "windows" AND EventType = "Process Creation" AND TgtProcCmdLine Contains 
Anycase "powershell.exe" AND TgtProcCmdLine Contains Anycase "-Command" AND TgtProcCmdLine 
Contains Anycase "Get-CimInstance" AND TgtProcCmdLine Contains Anycase "Win32_ShadowCopy"

Windows Event Log Cleared 

EndpointOS = "windows" AND ObjectType = "process" AND TgtProcCmdLine Contains Anycase 
"wevtutil" AND TgtProcCmdLine Contains Anycase " cl " AND TgtProcCmdLine In Contains 
Anycase ("Application", "Security", "System")

SentinelOne S1QL 1.0 query syntax (STAR rule):

RansomHub Ransomware

EndpointOS = "windows" AND EventType = "Process Creation" AND TgtProcCmdLine RegExp 
"\.exe\s{1,3}[A-Za-z0-9-]{0,20}\s{0,3}-pass\s[A-Za-z0-9]{64}"

Volume Shadow Copy Deletion

EndpointOS = "windows" AND EventType = "Process Creation" AND TgtProcCmdLine Contains 
Anycase "powershell.exe" AND TgtProcCmdLine Contains Anycase "-Command" AND TgtProcCmdLine 
Contains Anycase "Get-CimInstance" AND TgtProcCmdLine Contains Anycase "Win32_ShadowCopy"

Windows Event Log Cleared 

EndpointOS = "windows" AND ObjectType = "process" AND TgtProcCmdLine Contains Anycase 
"wevtutil" AND TgtProcCmdLine Contains Anycase " cl " AND TgtProcCmdLine In Contains 
Anycase ("Application", "Security", "System")

Note: These threat hunting queries may need to be tuned for your specific network environment.

Yara

rule RansomHub_ransomware_executable
{

meta:

author = “areteir.com”
description = “Detects the RansomHub ransomware executable”
target = “Windows systems”
file_type = “exe”
copyright = “Copyright © 2024 by Arete Advisors, LLC.”
distribution = “No re-distribution without Arete Advisors, LLC consent.”

strings:

$s1 = “json:\”local_disks\””
$s2 = “json:\”running_one\””
$s3 = “json:\”self_delete\””
$s4 = “json:\”white_files\””
$s5 = “json:\”white_hosts\””
$s6 = “json:\”credentials\””
$s7 = “json:\”kill_services\””
$s8 = “json:\”set_wallpaper\””
$s9 = “json:\”white_folders\””
$s10 = “json:\”note_file_name\””
$s11 = “json:\”note_full_text\””
$s12 = “json:\”kill_processes\””
$s13 = “json:\”network_shares\””
$s14 = “json:\”note_short_text\””
$s15 = “json:\”master_public_key\””

condition:

((uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550)) and
(9 of ($s*))

}

Recommended Mitigations

   - Utilize an endpoint detection and response (EDR) solution with the capability to halt detected processes
    and isolate systems on the network based on identified conditions.
   - Block any known attacker C2s in the firewall.
   - Implement multi-factor authentication on RDP and VPN to restrict access to critical network resources.
   - Eliminate unnecessary RDP ports exposed to the internet.
   - Block a high number of SMB connection attempts from one system to others in the network over a short period of time.
   - Perform periodic dark web monitoring to verify if data is available for sale on the black market.
   - Perform penetration tests.
   - Periodically patch systems and update tools.
   - Monitor connections to the network from suspicious locations.
   - Monitor downloads and uploads of files to file-sharing services outside standard work hours.
   - Monitor file uploads from domain controllers to the internet.
   - Monitor network scans from uncommon servers (e.g., RDP server)

   - Utilize an endpoint detection and response (EDR) solution with the capability to halt detected processes
    and isolate systems on the network based on identified conditions.
   - Block any known attacker C2s in the firewall.
   - Implement multi-factor authentication on RDP and VPN to restrict access to critical network resources.
   - Eliminate unnecessary RDP ports exposed to the internet.
   - Block a high number of SMB connection attempts from one system to others in the network over a short period of time.
   - Perform periodic dark web monitoring to verify if data is available for sale on the black market.
   - Perform penetration tests.
   - Periodically patch systems and update tools.
   - Monitor connections to the network from suspicious locations.
   - Monitor downloads and uploads of files to file-sharing services outside standard work hours.
   - Monitor file uploads from domain controllers to the internet.
   - Monitor network scans from uncommon servers (e.g., RDP server)

   - Utilize an endpoint detection and response (EDR) solution with the capability to halt detected processes
    and isolate systems on the network based on identified conditions.
   - Block any known attacker C2s in the firewall.
   - Implement multi-factor authentication on RDP and VPN to restrict access to critical network resources.
   - Eliminate unnecessary RDP ports exposed to the internet.
   - Block a high number of SMB connection attempts from one system to others in the network over a short period of time.
   - Perform periodic dark web monitoring to verify if data is available for sale on the black market.
   - Perform penetration tests.
   - Periodically patch systems and update tools.
   - Monitor connections to the network from suspicious locations.
   - Monitor downloads and uploads of files to file-sharing services outside standard work hours.
   - Monitor file uploads from domain controllers to the internet.
   - Monitor network scans from uncommon servers (e.g., RDP server)

Organizations can find the full list of US government-recommended ransomware prevention and mitigation guidance here: https://www.cisa.gov/stopransomware/ransomware-guide

Arete provides data-driven cybersecurity solutions to transform your response to emerging cyber threats.

Click here to learn more.

References

At Arete, we envision a world without cyber extortion, where people, businesses, and governments can thrive. We are taking all that we know from over 9,000 engagements to inform our solutions and strengthen powerful tools to better prevent, detect, and respond to the cyber extortion threats of tomorrow. Our elite team of experts provides unparalleled capabilities to address the entire cyber threat lifecycle, from incident response and restoration to advisory and managed security services. To learn more about our solutions, visit www.areteir.com.

Back to Blog Posts

Article

Jun 23, 2026

Europol Disrupts AudiA6 Crypto Laundering Service

European authorities have dismantled AudiA6, a major cryptocurrency laundering service linked to ransomware groups and broader cybercriminal networks. Between 2022 and 2025, the platform is believed to have processed over €336 million in illicit funds, enabling threat actors to obscure financial trails and monetize cybercrime proceeds. Its operators are also suspected of running Dark2Web, a dark web forum that facilitated collaboration, services, and connections among cybercriminals globally. This development underscores the expanding role of sophisticated, large-scale cryptocurrency laundering services in sustaining the cybercrime economy, enabling threat actors to obscure illicit funds and evade regulatory controls.

What’s Notable and Unique

Following law enforcement disruption of Cryptex and Garantex, AudiA6 emerged as another platform involved in financial activities linked to ransomware groups. Investigators believe that AudiA6 became a central hub for cybercriminals seeking to launder stolen digital assets while obscuring the transaction trail from authorities.

On June 10, 2026, a coordinated operation resulted in two arrests in Georgia, the dismantling of key infrastructure (30+ servers, 25 domains), the freezing or seizure of over €778,000 in crypto, and the takedown of the AudiA6 and Dark2Web platforms.

Analyst Comments

Ransomware groups and cybercriminal networks are increasingly leveraging sophisticated techniques, including chain-hopping, decentralized exchanges, and mixer-as-a-service platforms, to rapidly move illicit cryptocurrency across multiple blockchains, effectively obscuring transaction trails. Concurrently, the widespread use of fraudulent exchange accounts, mule wallets, and privacy-enhancing tools has elevated cryptocurrency laundering to a core enabler of the cybercrime ecosystem, allowing actors to bypass anti-money-laundering controls at scale. This investigation identified over 6,000 KYC records linked to money-mule accounts, many of which were tied to Russian-speaking intermediaries specifically recruited to facilitate the movement of illicit proceeds. These threat actors systematically used both commercial and domain-controlled email services to establish mule accounts across multiple cryptocurrency platforms. Collectively, these findings underscore the growing scale, coordination, and professionalization of cryptocurrency-enabled crime, highlighting the critical need for sustained, intelligence-led, and internationally coordinated efforts to disrupt these evolving financial ecosystems.

Sources

Ransomware gangs cut off from EUR 336 million ‘AudiA6’ crypto laundering pipeline

Article

Jun 12, 2026

Threat Actors Leverage AI for EDR Evasion

A threat actor has developed and deployed a ransomware attack toolkit enhanced with AI-assisted development workflows, enabling automated Active Directory (AD) discovery and improved EDR evasion capabilities. The toolkit leverages agent-based AI systems, such as Claude’s Opus and Cursor agents, for iterative malware development, testing, and refinement.

What’s Notable and Unique

Researchers have highlighted that this toolkit can not only generate ransomware code but also bypass sophisticated security defenses and identify AD networks for malware distribution.
The framework incorporates multiple capabilities, including automated AD discovery and reconnaissance mechanisms, iterative EDR testing environments to refine evasion techniques, and a command-and-control (C2) infrastructure that leverages Telegram APIs and Cloudflare redirectors for stealth.
Additionally, some agents were tasked with checking security research and technical posts for various bypass techniques. The agents recognized what was required for reproduction, extracted the techniques, mapped them to the MITRE ATT&CK knowledge base of adversary behaviors, set up a test lab, carried out the methodology, and reported the results.
After a few repetitions, the modules seemed to avoid nearly all EDR solutions, despite the agent’s initial suggestion of a high failure rate. Although researchers found no evidence that AI was embedded in deployed malware or was operating independently in victim environments, the technology was still used to accelerate the iterative process of developing, testing, and refining payloads against security products, shortening the period between the publication of offensive security research and its practical implementation by threat actors.

Analyst Comments

AI-driven tools like this could accelerate the pace and sophistication of ransomware attacks, enabling even relatively inexperienced actors to launch high-impact campaigns. This development underscores the urgent need for security solutions to adapt to AI-assisted threats. Organizations must respond by strengthening detection engineering, improving visibility across environments, and maintaining robust security fundamentals.

Sources

AI-built ransomware toolkit automates EDR evasion, AD discovery
Pointing a Cursor at evading detection

Article

Jun 3, 2026

Arete's 2026 Q1 Crimeware Report

Harness Arete’s unique data and expertise on extortion and ransomware to inform your response to the evolving threat landscape.

Article

May 29, 2026

CMS Vulnerability Leads to ClickFix Campaign

Threat actors compromised at least 700 education and technology websites in a recent ClickFix campaign by exploiting a critical SQL injection flaw (CVE-2026-26980) in the Ghost content management system (CMS). Adversaries combined the vulnerability with the ClickFix social engineering tactic to steal admin keys and inject a malicious JavaScript that delivers a fake Cloudflare or CAPTCHA verification pop-up, tricking victims into copying and pasting a malicious command into their systems.

What’s Notable and Unique

Rather than targeting the end user first, this campaign is unique in its initial exploitation of the system, followed by social engineering attempts. This hybrid attack style is likely being leveraged to bypass traditional defenses.

This recent campaign also highlights how trusted web properties can be weaponized at scale and coupled with unpatched CMS vulnerabilities. Rather than using the CMS compromise to perpetrate a single attack, threat actors turned it into a supply-chain attack that ultimately affected over 700 trusted websites.

Analyst Comments

As network defenders and their tools enhance threat detection capabilities, adversaries increasingly seek methods to bypass these defenses. By combining vulnerability exploitation, social engineering techniques, and staging for ancillary attacks, this campaign successfully bypassed traditional defenses and inflicted significant impact. Defending against hybrid cyberattacks requires comprehensive security controls beyond simply patching vulnerabilities. Organizations should focus on limiting movement within the environment, detecting abuse of trusted applications, and preventing end-user manipulation.

Sources

700+ education and tech websites hijacked in huge ClickFix malware campaign
Under the engineering hood: Why Malwarebytes chose WordPress as its CMS
Think before you Click(Fix): Analyzing the ClickFix social engineering technique
Ghost CMS Vulnerability Exploited to Infect 700 Sites With ClickFix Malware