With RansomHub actively exploiting zero-day vulnerabilities and recruiting displaced ALPHV/LockBit affiliates, organizations must strengthen endpoint security and ensure backup isolation to prevent potential attacks. RansomHub ransomware group leverages advanced evasion techniques, cross-platform encryption, and vulnerabilities in enterprise infrastructure. As this ransomware group done by expanding its arsenal to target Windows, VMware ESXi, Linux, and FreeBSD systems in global attacks. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news. RansomHub’s ransomware variants are tailored for diverse environments, featuring unique command-line arguments and encryption methods per platform. RansomHub affiliates exploit vulnerabilities such as CVE-2024-3400 (Palo Alto firewalls) and CVE-2021-42278/CVE-2020-1472 (Active Directory) for initial access. CISA urges organizations to immediately patch CVE-2024-3400 and audit remote services to mitigate the growing threat posed by RansomHub. The RansomHub ransomware group has rapidly emerged as one of the most prolific cybercrime syndicates of 2024–2025. Group-IB analysts have discovered that the group has compromised over 600 organizations, including healthcare, finance, and critical infrastructure sectors. The FreeBSD version, detected as Ransom.FreeBSD.INTERLOCK.THJBBBD, avoids critical directories (/boot, /etc) and appends .interlock to files. RansomHub’s affiliate panel, acquired from the defunct Knight ransomware, enables customizable ransom notes and leak site integrations. Tushar is a Cyber security content editor with a passion for creating captivating and informative content. The ESXi encryptor (C++-based) disrupts virtual machines using vim-cmd commands and encrypts VM files (.vmdk, .vmx) with ChaCha20 and Curve25519 algorithms. A flawed /tmp/app.pid check allows defenders to prevent encryption by writing -1 to the file, forcing an infinite loop.
This Cyber News was published on cybersecuritynews.com. Publication date: Mon, 17 Feb 2025 13:25:05 +0000