Ransomhub Group & New Betruger Backdoor | Technical Malware Analysis Report

RansomHub is a ransomware group that targets organizations worldwide, encrypting their data and demanding payment for decryption. Operating as a Ransomware-as-a-Service (RaaS) platform, the group collaborates with affiliates who carry out attacks using RansomHub’s tools and infrastructure. In addition to encrypting data, RansomHub threatens to leak stolen information if victims refuse to pay, increasing pressure on targeted organizations.

Like most ransomware groups, RansomHub is financially motivated, seeking to maximize its profits by extorting victims. The group often demands payments in cryptocurrency to make transactions harder to trace, and it carefully selects targets that are likely to pay large sums to recover their data. By compromising networks and exfiltrating sensitive information, RansomHub increases its leverage, making it more difficult for organizations to refuse their demands.

The group employs various techniques to infiltrate systems, including exploiting security vulnerabilities, phishing attacks, and abusing remote access tools.
Their targets often include large corporations, government agencies, and critical infrastructure providers, as these entities are more likely to suffer significant operational and financial damage if their data is compromised.