Understanding Ransomware-As-A-Service Risks

🚨New Advisory on RansomHub Ransomware🚨 The FBI, #CISA, MS-ISAC, and HHS have released a new joint advisory about the RansomHub ransomware, formerly known as Cyclops and Knight. This ransomware-as-a-service (RaaS) variant has become increasingly sophisticated, targeting critical infrastructure sectors like water and wastewater, IT, government, healthcare, and more. 🚑🏦🚛 Key Points to Know: 🔹Double Extortion Tactics: RansomHub encrypts data and exfiltrates it, demanding ransom for decryption and preventing data leaks. Victims are given a limited timeframe to comply before their data is published on the RansomHub Tor site. 🔹Growing Threat: Since February 2024, RansomHub has impacted over 200 victims, drawing affiliates from other major ransomware variants like LockBit and ALPHV. The RaaS model allows different threat actors to leverage this ransomware, increasing its reach and sophistication. 🔹Advanced Techniques and Tools: Affiliates gain initial access by utilizing a range of techniques, such as phishing, exploiting known vulnerabilities (like CVE-2023-3519), and password spraying. They also employ tools like Mimikatz for credential dumping and Cobalt Strike for lateral movement. Mitigation Steps: 1️⃣To protect against RansomHub, network defenders should: Install Security Updates: Keep all systems patched against known vulnerabilities. 2️⃣Implement Phishing-Resistant MFA: Use strong, non-SMS-based multi-factor authentication wherever possible. 3️⃣Conduct Regular Training: Ensure users are trained to recognize and report phishing attempts. 📧 4️⃣Network Segmentation and Monitoring: 🔥Segregate networks💥 to limit lateral movement and use network monitoring tools to detect abnormal activities. Stay Ahead of the Threat: This advisory aligns with NIST and CISA #ZeroTrust guidance (NIST 800-207, CISA Zero Trust Maturity Model) to help organizations enhance their cybersecurity posture against such evolving threats. By applying these guidelines, organizations can better prepare for and respond to ransomware attacks, protecting critical infrastructure and sensitive data. (Full disclosure: I was a co-author of both USG documents) 🛡️Read the complete advisory here: https://lnkd.in/er8pzSUx #cybersecurity #ransomware #technology

THREAT PROFILE: RANSOMHOUSE RANSOMWARE-AS-A-SERVICE (RAAS) OPERATION ℹ️ RansomHouse is a ransomware-as-a-service (RaaS) operation run by a threat group Unit 42 tracks as Jolly Scorpius. It combines data theft and file encryption with public extortion, meaning stolen data may be leaked if ransom demands aren’t met. The group has affected over 100 victims across sectors like healthcare, finance, government, and transportation. 📍 ATTACK CHAIN AND TOOLS ■ The operation uses an attack chain involving operators (developers of the ransomware service) and affiliates (attackers who compromise victim networks). ■ They often target VMware ESXi environments to maximize disruption across multiple virtual machines. ■ Two core components are: ◽ MrAgent – a deployment and control tool enabling persistence and command execution. ◽ Mario – the encryptor that performs the file encryption and drops ransom notes. 📍 ENCRYPTION UPGRADE ■ Originally, RansomHouse used a relatively simple, single-phase encryption routine. The new version of Mario implements a more complex, multi-layered encryption process, including: ◽ A two-factor encryption scheme using separate primary and secondary keys. ◽ Chunked processing of files, making analysis and decryption harder without keys. This marks a notable shift toward more resilient and harder-to-reverse ransomware code. 📍 IMPLICATIONS FOR DEFENDERS ■ The upgrade signals that RansomHouse is investing in increasing its technical complexity and resistance to defensive analysis. ■ Organizations with exposed ESXi systems are especially at risk, and defenders should strengthen network segmentation, patching, and threat detection to mitigate such threats. 📌 Source: Unit42 🔗 https://lnkd.in/eMFBzasp #ransomware #ransomhouse #raas #threathunting #threatdetection #threatanalysis #threatintelligence #cyberthreatintelligence #cyberintelligence #cybersecurity #cyberprotection #cyberdefense

OpenCLAW SOaC - RansomHub Defense Package RansomHub has rapidly become one of the most aggressive ransomware-as-a-service (RaaS) platforms in 2026. Post-ALPHV/BlackCat, affiliates pivoted hard, exploiting Citrix/Fortinet/VMware vulnerabilities, abusing RMM tools (AnyDesk, Atera), dumping credentials with Mimikatz, and exfiltrating via Rclone to Mega.nz. Their signature move? EDRKillShifter: BYOVD attacks that disable endpoint protection before encryption. Traditional PDF reports aren't enough. Security needs to be executable. Today I'm releasing OpenCLAW SOaC: RansomHub Defense Package: a fully GitHub package, community-driven framework to operationalize threat intelligence. 📦 What's Inside: ✅ 18 Detection Rules (KQL for Sentinel, IOAs for CrowdStrike/Defender) ✅ 7 SOAR Playbooks (Automated incident response via Logic Apps) ✅ 12 Security Policies (Conditional Access for Entra ID, EDR configs) ✅ 15 Threat Hunting Queries (Proactive KQL searches) ✅ Full MITRE ATT&CK Mapping (18+ techniques, 85% coverage) ✅ Deployment Guide + Testing Framework (Production-ready) 🎯 Tech Stack Coverage: Identity: Entra ID (Azure AD) SIEM: Microsoft Sentinel EDR: CrowdStrike Falcon + Microsoft Defender Cloud: M365 + AWS Traditional approach: 1. Read threat report 2. Manually write detections 3. Hope you caught everything 4. Repeat for every new threat actor SOaC approach: 1. Clone repository 2. Deploy detection rules in 10 minutes 3. SOAR playbooks auto-respond to incidents 4. Threat hunting queries run weekly 5. Share improvements back to the community Real-World Defenses You Get: 🔹 Detects EDRKillShifter (BYOVD driver exploitation) 🔹 Blocks RMM tool abuse (AnyDesk in \AppData) 🔹 Alerts on LSASS dumping (Mimikatz, ProcDump) 🔹 Catches data exfiltration (Rclone to Mega.nz >50MB transfers) 🔹 Identifies AD recon (ADFind, BloodHound, SharpHound) 🔹 Prevents shadow copy deletion (Pre-ransomware indicator) All mapped to MITRE ATT&CK. All tested. All free. 📊 By the Numbers RansomHub TTP Coverage: Initial Access: 90% (3 rules) Credential Access: 85% (4 rules) Discovery: 80% (3 rules) Exfiltration: 90% (3 rules) Defense Evasion: 75% (5 rules) Impact: 95% (2 rules) 🤝 Call to Action This is community-driven defense. If you: Deploy this package → Share results (sanitized!) Find false positives → Submit an issue Discover new RansomHub TTPs → Contribute detection rules Work in threat intel → Help me update the package Together, we raise the cost for attackers. This is SOaC world and this is how OpenCLAW is useful in your daily security operations. Forget about fancy AI SOC vendor lock-in. https://lnkd.in/eatT8nNM

The ransomware landscape is changing rapidly, with annual payments now soaring into the billions of dollars worldwide. A recent study illuminates this critical issue by using advanced heuristics to uncover $700 million in previously hidden ransomware payments. This discovery expands the dataset to a staggering $900 million—nearly four times larger than any other public dataset—offering unparalleled insights into the mechanics of the ransomware economy. The rise of Ransomware as a Service (RaaS) has turned these attacks into highly organized, large-scale operations. Research shows that affiliates—specialists in gaining network access and negotiating ransoms—often pocket the lion's share of the payments and frequently switch between ransomware groups. This constant movement, paired with escalating ransom demands and sophisticated evasion tactics, highlights the growing complexity and severity of ransomware threats. Transparency in ransomware payment data is vital for an effective defense. By harnessing blockchain analysis, partnering with law enforcement and financial institutions, and deploying innovative methods like shared exposure analysis, it is possible to gain a deeper understanding of the ransomware economy and find new ways to disrupt it. As the cybersecurity landscape continues to evolve, a multi-faceted approach is crucial to staying ahead of these ever-advancing threats. #Cybersecurity #Ransomware #Research #ThreatIntelligence Link to the research paper: https://lnkd.in/gWw9SFVq

When ransomware forces ambulances to turn away from hospitals, we've crossed a line from cybercrime to life-threatening attacks. Signature Healthcare in Massachusetts was just hit by the Anubis ransomware group, forcing them to divert ambulances and revert to paper charting systems while attackers claim to have stolen 2 terabytes of patient data. This isn't just another data breach, it's a direct assault on critical infrastructure that puts lives at immediate risk. In my experience, ransomware groups have evolved from opportunistic criminals to sophisticated threat actors who deliberately target healthcare during peak vulnerability. Anubis specifically weaponizes stolen data as leverage, knowing that healthcare organizations face the impossible choice between patient privacy and operational continuity. These groups study hospital workflows and strike when disruption causes maximum damage. Security teams need to use this commercial threat intelligence and act now. First, segment your critical systems so that a breach in one area doesn't cascade across your entire network. Second, implement real-time backup verification, not just backups, but tested, isolated backups that can't be encrypted by attackers. Third, establish clear incident response protocols that include communication plans for staff, patients, and regulatory bodies. Fourth, conduct tabletop exercises that simulate complete system failures, not just minor disruptions. The healthcare sector can't afford to treat cybersecurity as an IT problem anymore. When your network goes down, people's lives are now in additional peril. Every day you delay strengthening your defenses is another day you're gambling with patient safety. Here's the hard truth: most companies don't think seriously about cybersecurity until they're already in the middle of a breach, and by then, the damage is done. Don't wait until you're the next headline. Find experts who can help you assess your risks and build real defenses before attackers find your weaknesses for you.

The National Institute of Standards and Technology (NIST) has released an updated version of its Ransomware Risk Management Profile, aligning ransomware-specific guidance with the NIST Cybersecurity Framework (CSF) 2.0. The document maps ransomware risks to CSF outcomes and provides practical measures organizations can use to prevent, detect, respond to, and recover from ransomware incidents. Rather than introducing new controls, it explains how existing cybersecurity practices can be applied to address one of today's most persistent cyber threats. Some key highlights include: • Identity protection remains a foundational control: strong credential management, phishing-resistant multi-factor authentication, least-privilege access, and zero-trust principles are critical to reduce the risk of credential compromise (a common ransomware entry point). • Backups are essential for resilience: the document recommends maintaining tested backups and ensuring that at least one copy is protected from ransomware access, including through offline storage or other isolation measures. • Configuration and vulnerability management remain key preventive measures: timely patching, secure configuration management, replacement of unsupported software, and controls to prevent the execution of unauthorized software. • Continuous monitoring improves early detection: network activity, user behavior, systems, applications, and third-party service providers should be monitored to identify indicators of compromise and suspicious activity before ransomware can spread. • Cybersecurity awareness plays a critical role: the document highlights the importance of training users, administrators, and developers to recognize and avoid unsafe practices that can enable ransomware attacks. • Prepared incident response processes help limit impact: rapid execution of incident response plans, stakeholder communications, information sharing, and containment measures to reduce operational disruption. • Recovery planning is a critical component of ransomware preparedness: organizations should establish recovery procedures, verify the integrity of backups before restoration, prioritize recovery actions, and communicate recovery progress to relevant stakeholders. The profile provides a practical visual mapping between ransomware risk management activities and the NIST CSF 2.0, illustrating how organizations can apply established cybersecurity practices throughout the ransomware lifecycle.

🚨 Europol's Latest Blueprint of Criminal Opportunism: Stop Chasing Ransomware Brands. Start Understanding the Ecosystem. 🔹 Ransomware is increasingly falling under the broader category of financial extortion. The focus is no longer solely on encrypting systems. Increasingly, ransomware operations rely on data theft, extortion, and the threat of publishing stolen information. Many of the tactics remain the same, including the use of data leak sites to pressure victims, but the nature of ransomware has evolved. Our approach to understanding and responding to it should evolve as well. 🔹 The brand is not the organization. While ransomware brands may disappear after law enforcement action, the actors behind them often regroup, rebrand, or create splinter groups. In many instances, these are the same experienced actors who have operated together for years, building trusted relationships and resilient criminal ecosystems. Europol also highlights different operating models, from closed groups and semi-closed affiliate programs to mature Ransomware-as-a-Service (RaaS) operations, demonstrating just how diverse and adaptable these criminal enterprises have become. 🔹 Understanding the enemy is the first step to defeating it. Many of the most threatening criminal networks operate exclusively online while their members reside in jurisdictions beyond the reach of EU law enforcement. Europol notes that many cybercriminal networks involve Russian-speaking actors from CIS countries, but these groups are often multinational rather than homogeneous. Understanding their composition, geography, motivations, and operational environment is just as important as understanding their tooling and techniques. Decoding the human element behind these operations is equally important as decoding the technical aspects of cybercrime. 🔹 Mixed motivations are becoming the norm. The lines between cybercrime and hybrid threats continue to blur. Some criminal networks provide capabilities that can be leveraged by state or state-aligned actors, while states may in turn recruit cybercriminals for their expertise. These relationships are often driven by mutual benefit rather than ideology: criminal groups gain money, protection, or infrastructure, while hybrid threat actors gain expertise and plausible deniability. 🔹 Resilience is their greatest strength. Even after successful law enforcement operations, these networks adapt. They reorganize, relocate, recruit new affiliates, and continue operating under new brands. The ecosystem evolves far faster than individual groups disappear. Source: https://lnkd.in/g2Awgy_v Stay informed, stay secured with Analyst1 🦅

I posted this morning about the leak of LockBit’s internal systems—affiliate data, chats, handles, even their support ticket system. Lots of great questions about TRM Labs report. It’s like someone broke into McDonald’s HQ and posted the drive-thru headset transcripts, and the secret sauce recipe. 🍔 What does it mean? To understand the leak, you have to understand the model. And the model isn’t “lone genius hacker in a hoodie.” It’s franchising. It’s branding. It’s scale. It’s McDonald’s. 🍟 The Golden Arches of Cybercrime Ransomware-as-a-Service (RaaS) is a franchising model. The operators—LockBit, BlackCat, Cl0p—are corporate HQ. They build the malware (think: the Big Mac), maintain infrastructure (POS systems, payment portals, leak sites), and provide tools and templates (phishing kits = fry station training manual). Affiliates? They’re the franchisees. They pay for access to the “brand,” use the tech stack, deploy the payloads, and bring in the profits. They don’t need to invent anything—they just need to follow the playbook and execute. And just like McDonald’s franchises, the bar to entry is low. You don’t need to be a Michelin-star chef to open a location. You don’t need to be a top-tier hacker to join a RaaS program. Just bring ambition, a target list, and maybe a stolen credential or two. 🥤 Super-Sized Crime, Global Scale McDonald’s didn’t become a global powerhouse by flipping burgers in one city. They grew by replicating a model across borders. Same with ransomware. RaaS lets a small group of developers scale globally through a decentralized workforce of affiliates. Hit one, and ten more pop up. And the branding is real. LockBit’s name carries weight—like the McRib of ransomware. 🍔 The LockBit Leak: A Peek Behind the Counter The leak gives us something rare: a look at the inner workings of a RaaS empire. We can see how the franchisees operate, how disputes get resolved (yes, there are complaints about unpaid ransoms), and how the “customer service” team fields questions about bugs in the malware. 🍟 Breaking the Franchise Disrupting ransomware means going after the whole ecosystem, not just the local operator. Sanctions, arrests, and seizures are critical—but so is targeting the infrastructure: the malware-as-a-service portals, the hosting providers, the crypto wallets. And that’s what we’re starting to see—through coordinated international action, blockchain analytics, public-private partnerships like the Counter Ransomware Initiative, and major takedowns like Hive and Qakbot. 🥤 Final Thought: You Can’t Arrest the Brand You can shut down a McDonald’s franchise, but that doesn’t put Ronald out of business. The same is true of ransomware. As long as the model is profitable and the infrastructure exists, the next affiliate is just a download away. But here’s the opportunity: the LockBit leak gives us the roadmap. A look at how the model works, where it’s vulnerable, and how to hit it where it hurts.

Sometimes the bad guys do the work for us. This month, two new ransomware groups, 0APT and KryBit, decided their main problem wasn't defenders or law enforcement. It was each other. The short version, from our latest Halcyon report: 👉 0APT launched in January with 190+ "victims" posted on its leak site. All fabricated, just stage dressing to attract affiliates. It didn't work. They went dormant for three months. 👉 In April, 0APT re-emerged with a new plan: list rival ransomware groups as victims. They named KryBit, Everest, and RansomHouse. Everest yawned. RansomHouse was barely touched. But KryBit took notice. 👉 Within 24 hours, KryBit took over 0APT's leak site, defaced it with "Next time, don't play with the big boys," and dumped 0APT's operational data the next day. 👉 0APT's leak site infrastructure, it turns out, was running on Parrot OS and pushing content through the SD card of an Android phone. A ransomware-as-a-service "operation," held together by someone's mobile device. 👉 KryBit, by contrast, is the real thing. 20 victims, double extortion, ransom demands $40K to $100K. Worth tracking. Also worth noting: zero confirmed ransom payments so far. Somebody out there is doing the right thing. A few takeaways for defenders: The ransomware economy runs on reputation between criminals, and reputation is a brittle thing. When two operators decide to burn each other down, we end up with leaked admin panels, exposed affiliate IDs, BTC wallets, and Tox handles, all of it useful for tracking what comes next. These groups will rebrand and rebuild. They always do. The IOCs in our report are the head start. Both operators will be back within weeks. Even if under new names, watch for the same infrastructure patterns, the same affiliates, the same wallets. And if you needed another reminder that the bar to call yourself a "ransomware operation" is on the floor: Parrot OS, an Android phone, and a SQL injection away from oblivion. Full report linked in comments. #Ransomware #ThreatIntelligence #Cybersecurity #RaaS

While You Were Watching AI… Ransomware Got Worse Everyone in security is talking about AI — adversarial prompts, LLM abuse, deepfake phishing. Rightfully so. But let me ask a question that's been nagging me: Is anyone still watching the ransomware front? Spoiler: They should be. In 2025, 9,251 ransomware cases were recorded on the dark web — a 45% increase from 2024. December alone set a two-year record with over 1,000 incidents in a single month. Over 115 distinct ransomware groups were active last year, with 37 new groups entering the arena. And here's what's changed most: ransomware is no longer just about encryption. The old model — lock files, demand bitcoin, get paid — is being replaced by something nastier. Today's attacks follow a double (and even triple) extortion playbook: Exfiltrate your data first — before a single file is encrypted Encrypt your systems to cause operational chaos Threaten to publish or sell the stolen data — even if you restore from backup Contact your clients, partners, and regulators directly — to maximize pressure In 96% of the ransomware cases Arctic Wolf investigated, attackers also exfiltrated data. Backups don't save you from a HIPAA breach notification or a client data leak on the dark web. Ransomware-as-a-Service (RaaS) has democratized this threat. Low-skill affiliates can now deploy sophisticated attack kits from criminal developers, complete with coercive messaging scripts designed to break victim resolve. So what does good protection look like in 2026? I've been watching Halcyon (halcyon.ai) closely. Their Anti-Ransomware Platform was purpose-built — from day one — specifically to defeat ransomware, not retrofitted from a generic EDR. Their Ransomware Detection and Recovery (RDR) service, powered by an elite team called RISE, delivers 24/7 monitoring and response at no additional cost — a meaningful differentiator when most MDR add-ons carry a serious price tag. They recently partnered with Dell Technologies to deliver ransomware resilience baked directly into commercial PCs out of the box. Want real-time threat intelligence on active ransomware groups? Check out www.ransomware.live — a fascinating (and sobering) research site that tracks active ransomware gang activity, recent victims, and leak site data in near real time. Bookmark it. Reference it in your board presentations. Let it ground your risk conversations in current reality. The threat isn't sleeping while we debate AI governance frameworks. Ransomware operators are financially motivated, technically evolving, and operationally disciplined. Resilience isn't about assuming attacks won't happen. It's about ensuring your business survives when they do. Are you still treating ransomware as a "solved" problem? Drop your thoughts below. #Ransomware #Cybersecurity #ZeroTrust #CyberResilience #CISO #ThreatIntelligence #Halcyon #RansomwareLive #DataProtection #CyberLeadership