RansomHub Becomes 2024’s Top Ransomware Group, Hitting 600+ Organizations Globally
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2020-1472 | Unauthenticated Privilege Escalation (Zerologon) in Microsoft Netlogon Domain Controllers CVE-2020-1472, widely known as "Zerologon," is an elevation-of-privilege flaw in how the Netlogon secure channel is established over the Netlogon Remote Protocol (MS-NRPC) on Microsoft domain controllers. An unauthenticated attacker with network reachability to a domain controller sends specially crafted Netlogon messages to establish a vulnerable secure channel and then runs a specially crafted application on the network to obtain domain administrator access. Successful exploitation yields domain administrator privileges, effectively full compromise of the Active Directory environment, and the flaw is known to be used in ransomware operations. Any organization running affected Windows Server versions (2008 through 20H2) as domain controllers is exposed, along with environments using Netlogon implementations from Samba and distributions or products from Fedora, openSUSE, Canonical (Ubuntu), Debian, Synology, and Oracle. Exploitation is highly active: a public Zerologon PoC/exploit is available, the flaw is on CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03, with known ransomware use), and EPSS estimates a 99.4% probability of exploitation within 30 days. Do: Apply the vendor updates on all domain controllers and other affected systems immediately, following Microsoft's two-phase Netlogon secure channel guidance (the enforcement phase of the phased rollout began in Q1 2021). Audit Netlogon secure-channel connections and event logs for clients still using vulnerable connections before enabling full enforcement, and install updated packages for Samba and other Netlogon implementations from Fedora, openSUSE, Ubuntu, Debian, Synology, and Oracle. Given known ransomware use, prioritize patching any domain controller reachable from user networks, VPNs, or the internet. | 5.5 | 99% | KEV ransomware PoC |
| massmillions of domain controllers worldwide (essentially every Active Directory domain), with hundreds of thousands of domain controllers/RPC endpoints… | |
| CVE-2021-20038 | Unauthenticated Stack Buffer Overflow in SonicWall SMA 100 Appliances SonicWall SMA 100 series secure remote-access appliances contain an unauthenticated stack-based buffer overflow (CWE-121) in the appliance's network-facing interface, triggered by crafted requests sent to the device without any credentials. A remote attacker who triggers the overflow can execute arbitrary code on the appliance with the privileges of the affected service, gaining a foothold on an internet-facing VPN gateway that typically sits at the network edge. Any organization running an SMA 100 series appliance is affected, and because these appliances provide remote access to corporate networks, compromise can expose entire internal environments. Exploitation is confirmed in the wild: the flaw was added to CISA KEV on 2022-01-28 with known ransomware use, and EPSS assigns a 99.9% probability of exploitation within 30 days (100th percentile). No public proof-of-concept is catalogued in the provided data, but the KEV listing and EPSS score indicate active attacker interest. Do: Upgrade SMA 100 series appliances to firmware 10.0.7.2 or later per SonicWall's instructions, as required by the CISA KEV listing. Until patched, restrict internet exposure of the SMA portal and management interface to trusted sources where feasible. Because ransomware operators are known to exploit this flaw, review appliance logs for signs of compromise and monitor for unexpected account creation or traffic after patching. | 9.8 | 100% | KEV ransomware PoC ×2 |
| largetens of thousands of internet-exposed SMA 100 appliances (order of magnitude ~10,000-50,000 devices), plus a larger installed base used internally | |
| CVE-2021-42278 | Privilege Escalation via sAMAccountName Spoofing in Microsoft Active Directory CVE-2021-42278 is an elevation of privilege flaw in Microsoft Active Directory Domain Services (AD DS) caused by improper handling of changes to a computer account's sAMAccountName, allowing an attacker to 'spoof' a domain controller's name. A low-privileged authenticated user who can create or rename computer accounts (possible by default for ordinary domain users under MachineAccountQuota) renames a machine account to match a domain controller, obtains a Kerberos ticket for that name, and — typically chained with the related flaw CVE-2021-42287 — impersonates the domain controller to gain domain administrator rights. Successful exploitation yields full control of the Active Directory domain, which attackers, including ransomware operators, use to move laterally and deploy ransomware. Any organization running Active Directory on the affected Windows Server releases is exposed, though only servers with the AD DS role (domain controllers) reachable by an attacker with valid domain credentials are directly exploitable. The flaw is under active exploitation: it was added to CISA's Known Exploited Vulnerabilities catalog on 2022-04-11 with known ransomware use, and EPSS assigns a 73.3% probability of exploitation within 30 days. Do: Apply the Microsoft security updates for Active Directory Domain Services (released November 2021) to every domain controller, per CISA's required action. Until patched, restrict who can create or rename computer accounts (e.g., reduce MachineAccountQuota from the default 10) and audit domain controllers for renamed machine accounts and anomalous Kerberos tickets issued for domain controller names lacking the trailing '$'. Because CISA notes known ransomware use, hunt for signs of this flaw being chained with CVE-2021-42287 (the noPac technique) and for any new domain-admin activity on DCs. | 7.5 | 73% | KEV ransomware |
| mass≈1 million+ domain controllers across hundreds of thousands of organizations (AD is near-universal in Windows enterprise environments) | |
| CVE-2024-3400 | Unauthenticated Root Command Injection in Palo Alto Networks PAN-OS GlobalProtect Palo Alto Networks PAN-OS contains a command injection flaw (CWE-77, with improper input validation per CWE-20) in its GlobalProtect feature, allowing an unauthenticated attacker to execute arbitrary operating-system commands with root privileges on the affected firewall. The flaw is triggered through the GlobalProtect interface, which in most deployments is reachable from untrusted networks, so no valid user credentials or prior access are required. Successful exploitation yields full root control of the firewall, the most powerful position in a network perimeter, enabling traffic interception, configuration tampering, and use as a foothold for further compromise. All PAN-OS firewalls running affected releases with the GlobalProtect feature are exposed; CISA added the issue to the KEV catalog on 2024-04-12 with ransomware use noted, and EPSS puts the 30-day exploitation probability at 100% (100th percentile). No public proof-of-concept is recorded in the source data, but confirmed in-the-wild exploitation makes patching urgent. Do: Apply the PAN-OS patches released in Palo Alto Networks' bulletin according to its published patch schedule, prioritizing internet-facing firewalls. Until patched, enable the vendor's Threat Prevention signatures as required by CISA KEV, restrict exposure of the GlobalProtect interface to trusted sources where possible, and review logs and device configuration for signs of compromise given confirmed exploitation with known ransomware use. | 10.0 | 100% | KEV ransomware PoC ×2 |
| large≈10,000–100,000 internet-exposed PAN-OS firewalls with GlobalProtect enabled |
Full article950 words · extracted from thehackernews.com · click to collapse
The threat actors behind the RansomHub ransomware-as-a-service (RaaS) scheme have been observed leveraging now-patched security flaws in Microsoft Active Directory and the Netlogon protocol to escalate privileges and gain unauthorized access to a victim network's domain controller as part of their post-compromise strategy.
"RansomHub has targeted over 600 organizations globally, spanning sectors such as healthcare, finance, government, and critical infrastructure, firmly establishing it as the most active ransomware group in 2024," Group-IB analysts said in an exhaustive report published this week.
The ransomware group first emerged in February 2024, acquiring the source code associated with the now-defunct Knight (formerly Cyclops) RaaS gang from the RAMP cybercrime forum to speed up its operations. About five months later, an updated version of the locker was advertised on the illicit marketplace with capabilities to remotely encrypt data via SFTP protocol.
It comes in multiple variants that are capable of encrypting files on Windows, VMware ESXi, and SFTP servers. RansomHub has also been observed actively recruiting affiliates from LockBit and BlackCat groups as part of a partnership program, indicating an attempt to capitalize on the law enforcement actions targeting its rivals.
In the incident analyzed by the Singaporean cybersecurity company, the threat actor is said to have unsuccessfully attempted to exploit a critical flaw impacting Palo Alto Networks PAN-OS devices (CVE-2024-3400) using a publicly available proof-of-concept (PoC), before ultimately breaching the victim network by means of a brute-force attack against the VPN service.
"This brute force attempt was based on an enriched dictionary of over 5,000 usernames and passwords," the researchers said. "The attacker eventually gained access through a default account frequently used in data backup solutions, and the perimeter was finally breached."
The initial access was then abused to carry out the ransomware attack, with both data encryption and exfiltration occurring within 24 hours of the compromise.
Particularly, it involved the weaponization of two known security flaws in Active Directory (CVE-2021-42278 aka noPac) and the Netlogon protocol (CVE-2020-1472 aka ZeroLogon) to seize control of the domain controller and conduct lateral movement across the network.
"The exploitation of the above-mentioned vulnerabilities enabled the attacker to gain full privileged access to the domain controller, which is the nerve center of a Microsoft Windows-based infrastructure," the researchers said.
"Following the completion of the exfiltration operations, the attacker prepared the environment for the final phase of the attack. The attacker operated to render all company data, saved on the various NAS, completely unreadable and inaccessible, as well as impermissible to restore, with the aim of forcing the victim to pay the ransom to get their data back."
Another notable aspect of the attack is the use of PCHunter to stop and bypass endpoint security solutions, as well as Filezilla for data exfiltration.
"The origins of the RansomHub group, its offensive operations, and its overlapping characteristics with other groups confirm the existence of a vivid cybercrime ecosystem," the researchers said.
"This environment thrives on the sharing, reusing, and rebranding of tools and source codes, fueling a robust underground market where high-profile victims, infamous groups, and substantial sums of money play central roles."
The development comes as the cybersecurity firm detailed the inner workings of a "formidable RaaS operator" known as Lynx, shedding light on their affiliate workflow, their cross-platform ransomware arsenal for Windows, Linux, and ESXi environments, and customizable encryption modes.
An analysis of the ransomware's Windows and Linux versions shows that it closely resembles INC ransomware, indicating that the threat actors likely acquired the latter's source code.
"Affiliates are incentivized with an 80% share of ransom proceeds, reflecting a competitive, recruitment-driven strategy," it said. "Lynx recently added multiple encryption modes: 'fast,' 'medium,' 'slow,' and 'entire,' giving affiliates the freedom to adjust the trade-off between speed and depth of file encryption."
"The group's recruitment posts on underground forums emphasize a stringent verification process for pentesters and skilled intrusion teams, highlighting Lynx's emphasis on operational security and quality control. They also offer 'call centers' for harassing victims and advanced storage solutions for affiliates who consistently deliver profitable results."
In recent weeks, financially motivated attacks have also been observed using the Phorpiex (aka Trik) botnet malware propagated via phishing emails to deliver the LockBit ransomware.
"Unlike the past LockBit ransomware incidents, the threat actors relied on Phorpiex to deliver and execute LockBit ransomware," Cybereason noted in an analysis. "This technique is unique as ransomware deployment usually consists of human operators conducting the attack."
Another significant initial infection vector concerns the exploitation of unpatched VPN appliances (e.g., CVE-2021-20038) to gain access to internal network devices and hosts and ultimately deploy Abyss Locker ransomware.
The attacks are also characterized by the use of tunneling tools to maintain persistence, as well as leveraging Bring Your Own Vulnerable Driver (BYOVD) techniques to disable endpoint protection controls.
"After gaining access into the environment and performing reconnaissance, these tunneling tools are strategically deployed on critical network devices, including ESXi hosts, Windows hosts, VPN appliances, and network attached storage (NAS) devices," Sygnia researchers said.
"By targeting these devices, the attackers ensure robust and reliable communication channels to maintain access and orchestrate their malicious activities across the compromised network."
The ransomware landscape – led by threat actors new and old – continues to remain in a state of flux, with attacks pivoting from traditional encryption to data theft and extortion, even as victims increasingly refuse to pay up, leading to a decline in payments in 2024.
"Groups like RansomHub and Akira now incentivize stolen data with big rewards, making these tactics quite lucrative," cybersecurity firm Huntress said.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2025/02/ransomhub-becomes-2024s-top-ransomware.html