The latest evolution of the ransomware service model, RansomHub, has only been around since February of this year, but its affiliates are already successfully exfiltrating data.
You know you’re a problem when the U.S. government puts out a notice about you. That’s the case for RansomHub — the latest iteration of a ransomware as a service group formerly working under the names Cyclops and Knight.
It appears that their latest service model is pulling ransomware affiliate actors away from big names in the ransomware world like LockBit and ALPHV.
According to the CISA/NSA cybersecurity advisory, the group and its affiliates have successfully exfiltrated data from over 210 organizations since February of this year across a wide range of industries that include “water and wastewater, information technology, government services and facilities, healthcare and public health, emergency services, food and agriculture, financial services, commercial facilities, critical manufacturing, transportation, and communications critical infrastructure.”
In addition to a longer list of mitigations at the end of the advisory, the NSA make a few summary recommendations at the beginning to help organizations focus in on some of the most effective ways to stop ransomware:
- Install updates for operating systems, applications and firmware
- Use phishing-resistant MFA
- Implement security awareness training and include an ability for users to report phishing attacks
KnowBe4 empowers your workforce to make smarter security decisions every day. Over 70,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.
How BreachSim works:
