RansomHub: The New Face of an Old Enemy-Cyclops Evolution

[Tomcat]

A group with strong connections in cyberspace captures a large share in the hacker world.

Symantec conducted an analysis of the recently identified RansomHub ransomware and found out that the program turned out to be an updated and renamed version of Knight, which, in turn, is an evolution of another ransomware — Cyclops.

Knight (also known as Cyclops 2.0) first appeared in May 2023 and used double extortion tactics, stealing and encrypting victims ' data for financial gain. The virus works on a variety of platforms, including Windows, Linux, macOS, ESXi, and Android.

Knight was heavily advertised and sold on the RAMP forum. Attacks involving it often used phishing to distribute malicious attachments. Knight's operation as a RaaS model was discontinued at the end of February 2024, when the Knight source code was put up for sale. This gave reason to believe that the virus could have passed into the hands of a new owner, who decided to update and restart it under the RansomHub brand.

The RansomHub virus, whose first victim was recorded in the same month, is already linked to a series of recent attacks, including Change Healthcare, Christie's and Frontier Communications. It is noteworthy that the new version of the virus does not attack objects in the CIS countries, Cuba, North Korea and China.

Symantec noted that both versions of the virus are written in the Go language, and most of their variants are hidden using Gobfuscate. The correspondence in the code between the two families is significant, which makes it difficult to distinguish them. Both viruses have identical help menus, but RansomHub has added a new sleep option that allows you to stay in standby mode before executing commands. Similar commands were observed in other viruses – Chaos/Yashma and Trigona.

Similarities between Knight and RansomHub also include string hiding techniques, ransom notes, and the ability to reboot the system in secure mode before starting encryption. The main difference is the set of commands executed via cmd.exe, although the sequence of their invocation remains unchanged.

RansomHub Ransom Note

RansomHub attacks exploit ZeroLogon vulnerabilities to gain initial access and install remote management tools (Atera and Splashtop) before deploying the ransomware. According to Malwarebytes, in April 2024, this RansomHub was linked to 26 attacks.

Moreover, RansomHub is trying to attract members of other groups, including LockBit and BlackCat. It is reported that one of the former partners of Noberus, known as Notchy, is already working with RansomHub. In addition, tools previously linked to another Noberus partner, Scattered Spider, were used in the recent RansomHub attack.

The rapid development of RansomHub indicates that the group may consist of experienced hackers with strong connections in cyberspace. The development of the group is taking place against the background of a significant increase in the activity of ransomware. According to the Mandiant report, the number of publications on data leakage sites increased by 75% compared to the previous year.

 

[Tomcat]

Broadcom's Symantec uncovered the RansomHub ransomware gang, linking it to the now-retired Knight ransomware.

RansomHub, which operates in the traditional RaaS format, can't yet boast of the history of its brand and was formed in the ransomware community relatively recently.

The gang specializes in data theft and extortion, selling stolen files at auctions at the highest price offered by buyers.

RansomHub attracted attention in April when it published data stolen from a subsidiary of United Health Change Healthcare after the BlackCat/ALPHV attack, which led many to think of cooperation between them.

And more recently, on Border Guard Day, ransomware paid a visit to the international auction house Christie's, which acknowledged the incident after hackers threatened to reveal the stolen data.

In turn, Knight was launched at the end of July 2023 as a kind of rebranding of Cyclops and was used for attacks on Windows, macOS, Linux/ESXi, during which data was stolen and ransom was indicated.

One of the features of Knight was an information theft component that ransomware owners offered to their operators, making their attacks more effective.

In February 2024, the Knight cryptographer source code with version 3.0 was put up for sale in the cyber underground, the DLS portal was disabled, and RaaS was suspended.

But, as Symantec managed to find out, not for long, because later Knight returned in the image of RansomHub.

Analysts have found many similarities between the two strains of ransomware.

Both families are written in Go and use Gobfuscate for obfuscation. There is significant code duplication in two malware payloads.

RansomHub and Knight use the same unique obfuscation technique, where important strings are encoded with unique keys.

The ransom notes used by the two ransomware families are similar, with minor updates added by RansomHub.

Both strains restart the endpoints in safe mode before encryption. The command-line help menus in these two families are identical, with the only difference being that RansomHub has a "sleep"command.

The sequence and method of executing commands remained the same, but RansomHub now executes them via cmd.exe.

Finally, the time of RansomHub's appearance clearly coincides with the date of Knight's departure.

However, Symantec believes that other developers are behind RansomHub, which, apparently, having purchased Knight, began to use its modified version in attacks.

However, by now RansomHub has grown into one of the most efficient RaaS that Symantec associates with a gang that attracts former ALPHV operators like Notchy and Scattered Spider.