Ransomware Spotlight: Ransomhub

X

Infection chain and techniques

The following section details the initial infection chain observed from RansomHub activity as illustrated in Figure 1. Initial Access

The RansomHub ransomware group use spear-phishing voice scams for initial access. The cybercriminals use social engineering to orchestrate victim account password resets, employing speakers with a convincing American accent to lure victims. RansomHub also possibly uses compromised VPN accounts.

Execution

Operators behind RansomHub use PsExec to execute commands remotely on the victim’s machine. They have also been observed to use Powershell scripts to execute commands related to credential access, discover remote systems, establish SSH connections.…