The Change Healthcare Catalyst

The initial attack on Change Healthcare was executed by an affiliate operating under the ALPHV ransomware group. During this operation, the affiliate successfully exfiltrated substantial amounts of healthcare data and deployed ALPHV’s proprietary ransomware strain. However, what followed would reshape the ransomware landscape: ALPHV’s operators executed an exit scam, stealing the entire $22 million ransom payment that was meant to be shared with their affiliate. To cover their tracks, they posted a fake FBI takedown notice on their website.

Organizational Structure and Operations

Business Model

Ransomhub operates as a Ransomware-as-a-Service (RaaS) program, offering attractive terms to affiliates. Their operational motto, “Our team members are… interested [only] in dollars,” reflects their straightforward approach to cybercrime. This focus on financial gain, combined with competitive affiliate terms, has helped them rapidly attract experienced cybercriminals, particularly those displaced by law enforcement actions against other groups.

Technical Capabilities

Ransomhub’s technical infrastructure demonstrates sophisticated capabilities across multiple platforms:

1. Multi-Platform Targeting:
   • Windows operating systems
   • Linux environments
   • VMware ESXi hypervisor systems
2. Initial Access Vectors:
   • Phishing campaigns
   • Exploitation of unpatched vulnerabilities
   • Compromised credentials (RDP, VPN, and Citrix)

Advanced Evasion Techniques

EDRKillShifter Implementation

One of Ransomhub’s most notable technical innovations is the EDRKillShifter tool, which represents a significant advancement in EDR (Endpoint Detection and Response) evasion capabilities. The tool employs several sophisticated techniques:

1. BYOVD (Bring Your Own Vulnerable Driver):
   • Loads legitimate but vulnerable drivers
   • Exploits these drivers to elevate privileges
   • Disables active EDR processes and services
2. Sophisticated Process Manipulation:
   • Implements configurable commands
   • Uses heavy code obfuscation
   • Shares programming characteristics with previous ransomware strains

Operational Methodology

Double Extortion Strategy

Ransomhub employs a refined double extortion approach:

1. Initial Phase:
   • Gain unauthorized system access
   • Exfiltrate sensitive data
   • Deploy ransomware payload
2. Extortion Phase:
   • Demand ransom for system decryption
   • Threaten data publication for additional leverage
   • Utilize stolen data for extended pressure tactics

Geographic Targeting

Ransomhub maintains specific operational boundaries, explicitly prohibiting attacks against entities in:

• China
• Cuba
• North Korea
• Romania
• Commonwealth of Independent States (CIS) countries

Current Impact and Market Position

Rapid Growth

By Q3 2024, Ransomhub had established itself as the leading ransomware operation in terms of claimed successful attacks. Key statistics include:

• 191 victims posted to leak sites in Q3 2024
• 155% increase from Q2 2024
• Primary targeting of North American and European organizations
• 107 documented victims by July 2024

Market Dynamics

Ransomhub’s rise coincided with significant changes in the ransomware ecosystem:

1. LockBit’s Decline:
   • 88% decrease in LockBit attacks following law enforcement operations
   • Shift in affiliate loyalty to newer platforms
2. Competitive Advantage:
   • More attractive affiliate terms
   • Consistent operational success
   • Advanced technical capabilities

Technical Infrastructure

Ransomware Characteristics

Ransomhub’s malware combines features from various ransomware strains:

1. Security Feature Manipulation:
   • Ability to disable device security through safe mode exploitation
   • Advanced process termination capabilities
   • Sophisticated system manipulation techniques
2. Code Structure:
   • Shared programming language elements with Snatch ransomware
   • Enhanced code obfuscation techniques
   • Configurable command structure
3. Ransomware note:

Hello!

Visit our Blog:
Tor Browser Links:
http://ransomxifxwc5eteopdobynonjctkxxvap77yqifu2emfbecgbqdw6qd.onion/
Links for normal browser:
http://ransomxifxwc5eteopdobynonjctkxxvap77yqifu2emfbecgbqdw6qd.onion.ly/

Your data is stolen and encrypted.

If you don’t pay the ransom, the data will be published on our TOR darknet sites. Keep in mind that once your data appears on our leak site, it could be bought by your competitors at any second, so don’t hesitate for a long time. The sooner you pay the ransom, the sooner your company will be safe.

If you have an external or cloud backup; what happens if you don’t agree with us?

All countries have their own PDPL (Personal Data Protection Law) regulations. In the event that you do not agree with us, information pertaining to your companies and the data of your company’s customers will be published on the internet, and the respective country’s personal data usage authority will be informed. Moreover, confidential data related to your company will be shared with potential competitors through email and social media. You can be sure that you will incur damages far exceeding the amount we are requesting from you should you decide not to agree with us.

How to contact with us?

• Install and run ‘Tor Browser’ from https://www.torproject.org/download/
• Go to http://cki3klxqycazagx3r5prae3nmfvxmwa34beknr3il4uf76vxd76akqid.onion/
• Log in using the Client ID: [snip]

WARNING

DO NOT MODIFY ENCRYPTED FILES YOURSELF.
DO NOT USE THIRD PARTY SOFTWARE TO RESTORE YOUR DATA.
YOU MAY DAMAGE YOUR FILES, IT WILL RESULT IN PERMANENT DATA LOSS.

This link (TOR) is your private blog link. Right now it is only available to you but in 72 hours if you don’t get in touch it will be published on our platform and will be seen by thousands of journalists: ransomxifxwc5eteopdobynonjctkxxvap77yqifu2emfbecgbqdw6qd.onion/[snip]/

Free Methods to Attempt Recovery

Though decryption without the attacker’s key is challenging, there are still steps you can take, many of which are free. Here are several methods to attempt:

1. Check for Existing Decryptor Tools

• NoMoreRansom Project: This collaborative effort between law enforcement agencies and cybersecurity firms offers free decryption tools for various ransomware variants. While Ransomhub is not currently listed as supported, it’s worth checking periodically for updates, as cybersecurity experts continually analyze ransomware strains and may eventually release a decryptor.
  • Visit: NoMoreRansom.org
• Kaspersky Ransomware Decryptor: Kaspersky provides decryption tools for certain ransomware strains. While Ransomhub is not currently supported, monitoring security providers for updates could provide a future solution.

2. Restoring from Backups

• If you have recent backups of your encrypted data, this is the best solution for recovery. You should regularly back up your files, and it is especially crucial to have offline backups that are immune to ransomware attacks. If backups exist, follow the steps below:
  1. Isolate the infected system to prevent the ransomware from spreading further.
  2. Remove the ransomware by performing a clean reinstallation of the operating system.
  3. Restore your files from backups stored on an external drive, cloud service, or other secure locations.

3. Volume Shadow Copy Service (VSS) Restoration

• Some ransomware variants attempt to delete Volume Shadow Copies, which are backups Windows automatically creates. If the ransomware did not delete these backups, you may be able to restore your system using this service.
  • To check if shadow copies are available:
    1. Open the Command Prompt as an administrator.
    2. Type vssadmin list shadows and press Enter.
    3. If there are any available snapshots, you can attempt to restore files from them using tools like ShadowExplorer.
  • Keep in mind that Ransomhub affiliates often use tools like vssadmin.exe to delete these backups during their attack, so this method may not always work​(ransomhub).

4. System Restore

• If your operating system has System Restore points enabled, you may be able to revert your system to a state before the infection occurred. This method won’t recover encrypted files but may help restore some system functionality or prevent further damage.
  • To restore your system:
    1. Access System Restore via Control Panel or the Recovery menu during startup.
    2. Choose a restore point from before the infection and follow the on-screen instructions.

5. Data Recovery Tools

• In some cases, even after ransomware encrypts files, remnants of unencrypted data may remain on the hard drive. Free data recovery tools like Recuva or PhotoRec can sometimes recover deleted or unencrypted versions of files.
  • These tools work best when the ransomware does not overwrite or fully delete the original data. Although success is not guaranteed, running these programs may recover partial or older versions of your files.

6. Contact Law Enforcement

• Reporting the ransomware incident to local or national cybersecurity agencies (such as the FBI or CISA in the U.S.) can sometimes yield results. These agencies often work with cybersecurity firms to analyze ransomware and potentially crack its encryption. Law enforcement may also provide guidance on how to proceed without paying the ransom.
  • Report incidents to CISA’s Ransomware Reporting System or the FBI’s Internet Crime Complaint Center (IC3).

7. Avoid Paying the Ransom

• Do not pay the ransom. Paying the attackers does not guarantee they will provide a decryption key, and in some cases, paying emboldens the ransomware group to continue attacking others. Moreover, paying could expose you to further exploitation, as the attackers now know you are willing to negotiate.

8. Regularly Monitor Security Updates

• Cybersecurity researchers and organizations regularly release updates on newly discovered vulnerabilities and ransomware decryption methods. Subscribing to security alerts from platforms like BleepingComputer, Sophos, or CISA can help keep you informed of any new developments in Ransomhub decryption efforts.

9. Engage with Security Forums

• Participating in cybersecurity forums such as Reddit’s r/ransomware, BleepingComputer’s forums, or other online communities can sometimes yield advice from experts or victims who may have encountered similar strains of ransomware. Fellow users may offer insights on specific vulnerabilities or unpatched flaws in the ransomware’s encryption method.

Proactive Defense and Prevention

While decryption methods for Ransomhub may be limited at this time, the best defense against ransomware is proactive prevention. Here are some steps you can take to protect your systems from future ransomware attacks:

1. Use Strong Passwords: Enable multi-factor authentication (MFA) wherever possible, and use strong, unique passwords.
2. Patch Known Vulnerabilities: Keep your systems updated with the latest security patches to prevent attackers from exploiting known vulnerabilities, which is a common tactic used by Ransomhub.
3. Segment Networks: Divide your network into separate segments to limit the damage in case of an attack.
4. Install Antivirus Software: Ensure your antivirus software is updated and capable of detecting and removing ransomware.
5. Educate Employees: Regularly train employees to recognize phishing attempts and other common attack vectors.
6. Monitor Threat Feeds: Stay informed about emerging ransomware threats by subscribing to cybersecurity threat feeds or receiving alerts from agencies like CISA.

Future Implications

The emergence and rapid success of Ransomhub represents a significant evolution in the ransomware threat landscape. Their technical sophistication, particularly in EDR evasion, combined with their business approach, suggests a continued threat to organizational security. The group’s rapid rise to prominence, despite being relatively new, indicates potential for further expansion and development of their capabilities.

Prevention through regular system updates, strong security practices, and employee training remains crucial to minimizing the risk of infection. If infected, seek expert help and consider using the Ransomhub Decryptor for safe and effective file recovery.