RansomHub emerged in 2024 and rapidly became one of the most active RaaS operations, attracting experienced affiliates displaced by the disruption of LockBit and ALPHV.

Key facts

• Grew quickly by offering attractive affiliate terms, drawing skilled operators from disrupted groups.
• Uses double extortion with a leak site and cross-platform encryptors.
• Targets a broad range of sectors including healthcare, government and critical services.
• Illustrates how the RaaS ecosystem reconstitutes itself after takedowns.

Why it matters

RansomHub shows that disrupting one brand does not remove the affiliates behind the attacks. Continuous monitoring matters more than tracking any single group name.

How DarkThreatX helps

DarkThreatX monitors dark web leak sites, forums and marketplaces for activity and data tied to your organisation, so you can respond before exposure becomes a breach. Run a free dark web scan or explore the platform.