- Category
- Criminal · Financially motivated: ransomware, fraud and theft.
- Origin
- Unknown
- Seen
- 2024–2025
- Status
- Active
- Sources
- 3 sources carry it
- Identifier
- GINC-APT-0902 · ransomhub
What it is
RansomHub is a dominant ransomware-as-a-service operation that emerged in 2024 and quickly became the most prolific group with 736 disclosed victims.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- Other names
- RansomHub RaaS
Targets
- Sectors
- Critical Infrastructure, Education, Healthcare, Manufacturing
Tools
The tools and malware families the sources tie to it.
- Xploit
Sources
- Malpedia malpedia.caad.fkie.fraunhofer.de