In a previous Inside the SOC blog, Darktrace investigated RansomHub and its growing impact on the threat landscape due to its use by the ShadowSyndicate threat group. Here, RansomHub is revisited with new insights on this ransomware-as-a-service (RaaS) platform that has rapidly gained traction among threat actors of late.

In recent months, Darktrace’s Threat Research team has noted a significant uptick in potential compromises affecting the fleet, indicating that RansomHub is becoming a preferred tool for cybercriminals.  This article delves into the increasing adoption of RansomHub, the tactics, techniques, and procedures (TTPs) employed by its affiliates, and the broader implications for organizations striving to protect their systems.

RansomHub overview & background

One notable threat group to have transitioned from from ALPHV (BlackCat)-aligned operations to RansomHub-aligned operations is ScatteredSpider [1]. The adoption of RansomHub by ScatteredSpider and other threat actors suggests a possible power shift among threat groups, given the increasing number of cybercriminals adopting it, including those who previously relied on ALPHV’s malware code [2].

ALPHV was a RaaS strain used by cybercriminals to breach Change Healthcare in February 2024 [2]. However, there are claims that the ransom payment never reached the affiliate using ALPHV, leading to a loss of trust in the RaaS. Around the same time, Operation Cronos resulted in the shutdown of LockBit and the abandonment of its affiliates [2]. Consequently, RansomHub emerged as a prominent RaaS successor.

RansomHub targets

The RansomHub ransomware group has been observed targeting various sectors, including critical infrastructure, financial and government services, and the healthcare sector [4]. They use ransomware variants rewritten in GoLang to target both Windows and Linux systems [5]. RansomHub is known for employing double extortion attacks, encrypting data using “Curve25519” encryption [6].

RansomHub tactics and techniques

The attackers leverage phishing attacks and social engineering techniques to lure their victims. Once access is gained, they use sophisticated tools to maintain control over compromised networks and exploit vulnerabilities in systems like Windows, Linux, ESXI, and NAS.

In more recent RansomHub attacks, tools such as Atera and Splashtop have been used to facilitate remote access, while NetScan has been employed to discover and retrieve information about network devices [7].

External researchers have observed that RansomHub uses several legitimate tools, or a tactic known as Living-off-the-Land (LOTL), to carry out their attacks. These tools include:

• SecretServerSecretStealer: A PowerShell script that allows for the decryption of passwords [1].
• Ngrok: A legitimate reverse proxy tool that creates a secure tunnel to servers located behind firewalls, used by the group for lateral movement and data exfiltration.
• Remmina: An open-source remote desktop client for POSIX-based operating systems, enabling threat actors to access remote services [1].

By using these legitimate tools instead of traditional malware, RansomHub can avoid detection and maintain a lower profile during their operations.

Darktrace’s Coverage of RansomHub

Darktrace’s Security Operations Center (SOC) detected several notable cases of likely RansomHub activity across the customer base in recent months. In all instances, threat actors performed network scanning and brute force activities.

During the investigation of a confirmed RansomHub attack in January 2025, the Darktrace Threat Research team identified multiple authentication attempts as attackers tried to retrieve valid credentials. It is plausible that the attackers gained entry to customer environments through their Remote Desktop (RD) web server. Following this, various RDP connections were made to pivot to other devices within the network.

The common element among the cases investigated was that, in most instances, devices were seen performing outgoing connections to splashtop[.]com, a remote access and support software service, after the scanning activity had occurred. On one customer network, following this activity, the same device was seen connecting to the domain agent-api[.]atera[.]com and IP 20.37.139[.]187, which are seemingly linked to Atera, a Remote Monitoring and Management (RMM) tool.

In a separate case, a Darktrace observed a device attempting to perform SMB scanning activity, trying to connect to multiple internal devices over port 445. Cyber AI Analyst was able to detect and correlate these individual connections into a single reconnaissance incident.

Similar connections to Remote Monitoring and Management (RMM) tools were also detected in a different customer environment, as alerted by Darktrace’s SOC. Unusual connections to Splashtop and Atera were made from the alerted device. Following this, the same device was observed sending a large volume of data over SSH Rclone to a rare external endpoint on the unusual port 448, triggered multiple models in Darktrace / NETWORK.

In the cases observed, data exfiltration occurred alongside the encryption of files likely indicating double extortion tactics. In September 2024, the Darktrace’s Threat Research team identified a 6-digit alphanumeric additional extension similar to “.293ac3”. This case was closely linked to a RansomHub attack, which was also analyzed in a different blog post by Darktrace [8].

Conclusion

RansomHub exemplifies the evolving RaaS ecosystem, where threat actors capitalize on ready-made platforms to launch sophisticated attacks with ease. The activities observed highlight its growing popularity among cybercriminals. The analysis showed that the different attacks investigated followed a similar pattern of activity.

First, attackers perform reconnaissance activities, including widespread scanning from multiple devices and reverse DNS sweeps. They then use high-privileged credentials to pivot among devices and establish remote connections using RMM tools such as Atera. A common element among most attacks that reached the data encryption stage is the use of a 6-digit alphanumeric extension.

In all cases, Darktrace alerted on the unusual activities observed, creating not only model alerts but also Cyber AI Analyst incidents. Both Darktrace Security Operations Support and Darktrace Managed Threat Detection services provided 24/7 assistance to clients affected by RansomHub. The analyst team continued investigating these incidents, gathering data and IoCs seen in the RansomHub incidents, providing valuable insight and guidance throughout the process.

As RansomHub continues to gain traction, it serves as a stark reminder of the need for robust cybersecurity measures, proactive threat intelligence, and continued vigilance.

Credit to Maria Geronikolou (Cyber Analyst) and Nahisha Nobregas (Senior Cyber Analyst)

Appendices

Darktrace Model Detections

Network Reconnaissance

o   Device / Network Scan

o   Device / ICMP Address Scan

o   Device / RDP Scan

o   Device / Anomalous LDAP Root Searches

o   Anomalous Connection / SMB Enumeration

o   Device / Spike in LDAP Activity

o   Device / Suspicious Network Scan Activity

Lateral Movement

o   Device / Multiple Lateral Movement Model Alerts

o   Device / Increase in New RPC Services

o   Device / New or Uncommon WMI Activity

o   Device / Possible SMB/NTLM Brute Force

o   Device / SMB Session Brute Force (Non-Admin)

o   Device / Anomalous NTLM Brute Force

o   Compliance / Default Credential Usage

o   Compliance / Outgoing NTLM Request from DC

C2 Activity

o   Anomalous Server Activity / Outgoing from Server

o   Anomalous Connection / Multiple Connections to New External TCP Port

o   Unusual Activity / Unusual External Activity

o   Compliance / Remote Management Tool On Server

Data Exfiltration

o   Unusual Activity / Enhanced Unusual External Data Transfer

o   Anomalous Connection / Outbound SSH to Unusual Port

o   Compliance / SSH to Rare External Destination

o   Unusual Activity / Unusual External Data to New Endpoint

o   Unusual Activity / Unusual External Data Transfer

o   Attack Path Modelling / Unusual Data Transfer on Critical Attack Path

o   Compliance / Possible Unencrypted Password File On Server‍

Autonomous Response Models

-       Antigena / Network / Significant Anomaly / Antigena Significant Anomaly from Client Block

-       Antigena/Network/Insider Threat/Antigena SMB Enumeration Block

-       Antigena / Network / Significant Anomaly / Antigena Alerts Over Time Block

-       Antigena / Network / Significant Anomaly / Antigena Controlled and Model Alert

List of Indicators of Compromise (IoCs)

o   38.244.145[.]85

o   20.37.139[.]187 agent-api.atera[.]com

o   108.157.150[.]120 ps.atera[.]com

o   st-v3-univ-srs-win-3720[.]api[.]splashtop[.]com

MITRE ATT&CK Mapping

• RECONNAISSANCE T1592.004
• RECONNAISSANCE T1595.002
• DISCOVERY T1046
• DISCOVERY T1083
• DISCOVERY T1135
• DISCOVERY T1018
• INITIAL ACCESS T1190
• CREDENTIAL ACCESS T1110
• LATERAL MOVEMENT T1210
• COMMAND AND CONTROL T1001
• EXFILTRATION T1041
• EXFILTRATION T1567.002

References

[1] https://www.guidepointsecurity.com/blog/worldwide-web-an-analysis-of-tactics-and-techniques-attributed-to-scattered-spider/

[2] https://www.theregister.com/2024/07/16/scattered_spider_ransom/

[3] https://krebsonsecurity.com/2024/03/blackcat-ransomware-group-implodes-after-apparent-22m-ransom-payment-by-change-healthcare/

[4] https://thehackernews.com/2024/09/ransomhub-ransomware-group-targets-210.html

[5] https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-ransomhub

[6] https://areteir.com/article/malware-spotlight-ransomhub-ransomware/
[7] https://www.security.com/threat-intelligence/ransomhub-knight-ransomware

[8] https://darktrace.com/blog/ransomhub-ransomware-darktraces-investigation-of-the-newest-tool-in-shadowsyndicates-arsenal

Forecasts predict public cloud spending will soar to over $720 billion by 2025, with 90%^[1] of organizations embracing a hybrid cloud approach by 2027. These figures could also be eclipsed as more businesses unearth the potential impact that AI can make on their productivity. The pace of evolution is staggering, but one thing hasn’t changed: the cloud security market is a maze of complexity. Filled with acronyms, overlapping capabilities, and endless use cases tailored to every buyer persona.

On top of this, organizations face a fragmented landscape of security tools, each designed to cover just one slice of the cloud security puzzle. Then there’s CNAPP (Cloud-Native Application Protection Platform) — a broad platform promising to do it all but often falling short, especially around providing runtime detection and response capabilities. It’s no wonder organizations struggle to cut through the noise and find the precision they require.

Looking more closely at what CNAPP has to offer, it can feel like as if it is all you would ever need, but is that really the case?

Strengths and limitations of CNAPP

A CNAPP is undeniably a compelling solution, originally coming from CSPM (Cloud Security Posture Management), it provided organizations with a snapshot of their deployed cloud assets, highlighting whether they were as secure as intended. However, this often resulted in an overwhelming list of issues to fix, leaving organizations unsure where to focus their energy for maximum impact.

To address this, CNAPP’s evolved, incorporating capabilities like; identifying software vulnerabilities, mapping attack paths, and understanding which identities could act within the cloud. The goal became clear: prioritize fixes to reduce the risk of compromise.

But what if we could avoid these problems altogether? Imagine deploying software securely from the start — preventing the merging of vulnerable packages and ensuring proper configurations in production environments by shifting left. This preventative approach is vital to any “secure by design” strategy, CNAPP’s again evolving to add this functionality alongside.

However, as applications grow more complex, so do the variety and scope of potential issues. The responsibility for addressing these challenges often falls to engineers, who are left balancing the pressure to write code with the burden of fixing critical findings that may never even pose a real risk to the organization.

While CNAPP serves as an essential risk prevention tool — focusing on hygiene, compliance, and enabling organizations to deploy high-quality code on well-configured infrastructure — its role is largely limited to reducing the potential for issues. Once applications and infrastructure are live, the game changes. Security’s focus shifts to detecting unwanted activity and responding to real-time risks.

Limitations of CNAPP

Here’s where CNAPP shows its limitations:

1. Blind spots for on-premises workloads

Designed for cloud-native environments, it can leave blind spots for workloads that remain on-premises — a significant concern given that 90% of organizations are expected to adopt a hybrid cloud strategy by 2027. These blind spots can increase the risk of cross-domain attacks, underscoring the need for a solution that goes beyond purely prevention but adds real-time detection and response.

2. Detecting and mitigating cross-domain threats

Adversaries have evolved to exploit the complexity of hybrid and cloud environments through cross-domain attacks. These attacks span multiple domains — including traditional network environments, identity systems, SaaS platforms, and cloud environments — making them exceptionally difficult to detect and mitigate. Attackers are human and will naturally choose the path of least resistance, why spend time writing a detailed software exploit for a vulnerability if you can just target the identity?

Imagine a scenario where an attacker compromises an organization via leaked credentials and then moves laterally, similar to the example outlined in this blog: The Price of Admission: Countering Stolen Credentials with Darktrace. If an attacker identifies cloud credentials and moves into the cloud control plane, they could access additional sensitive data. Without a detection platform that monitors these areas for unusual activity, while working to consolidate findings into a unified timeline, detecting these types of attacks becomes incredibly challenging.

A CNAPP might only point to a potential misconfiguration of an identity or for example a misconfiguration around secret storage, but it cannot detect when that misconfiguration has been exploited — let alone respond to it.

Identity + Network: Unlocking cross-domain threats

Identity is more than just a role or username; it is essentially an access point for attackers to leverage and move between different areas of a digital estate. Real-time monitoring of human and non-human identities is crucial for understanding intent, spotting anomalies, and preventing possible attacks before they spread.

Non-human roles, such as service accounts or automation tooling, often operate with trust and without oversight. In 2024, the Cybersecurity and Critical Infrastructure Agency (CISA) ^[2] released a warning regarding new strategies employed by SolarWinds attackers. These strategies were primarily aimed at cloud infrastructure and non-human identities. The warning details how attackers leverage credentials and valid applications for malicious purposes.

With organizations opting for a hybrid approach, combining network, identity, cloud management and cloud runtime activity is essential to detecting and mitigating cross domain attacks, these are just some of the capabilities needed for effective detection and response:

• AI driven automated and unified investigation of events – due to the volume of data and activity within businesses digital estates leveraging AI is vital, to enable SOC teams in understanding and facilitating proportional and effective responses.
• Real-time monitoring auditing combined with anomaly detection for human and non-human identities.
• A unified investigation platform that can deliver a real-time understanding of Identity, deployed cloud assets, runtime and contextual findings as well as coverage for remaining on premises workloads.
• The ability to leverage threat intelligence automatically to detect potential malicious activities quickly.

The future of cloud security: Balancing risk management with real-time detection and response

Darktrace / CLOUD's CDR approach enhances CNAPP by providing the essential detection and native response needed to protect against cross-domain threats. Its agentless, default setup is both cost-effective and scalable, creating a runtime baseline that significantly boosts visibility for security teams. While proactive controls are crucial for cloud security, pairing them with Cloud Detection and Response solutions addresses a broader range of challenges.

With Darktrace / CLOUD, organizations benefit from continuous, real-time monitoring and advanced AI-driven behavioural detection, ensuring proactive detection and a robust cloud-native response. This integrated approach delivers comprehensive protection across the digital estate.

Unlock advanced cloud protection

Download the Darktrace / CLOUD solution brief to discover how autonomous, AI-driven defense can secure your environment in real-time.

‍

‍

References

1. https://www.gartner.com/en/newsroom/press-releases/2024-11-19-gartner-forecasts-worldwide-public-cloud-end-user-spending-to-total-723-billion-dollars-in-2025
2. https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-057a