Darktrace Details RansomHub Tactics and Activity in Customer Networks
Summary
Darktrace describes RansomHub’s growing use and reports observed activity including network scanning, credential attempts, lateral movement via remote-management tools, data exfiltration, and file encryption.
Key points
- Darktrace reports a rise in potential RansomHub compromises and describes the group as gaining traction among ransomware affiliates.
- The article says affiliates target Windows and Linux systems across sectors, using phishing, social engineering, and exploited vulnerabilities.
- Observed activity included network scanning, brute-force authentication attempts, RDP connections, and attempts to pivot using privileged credentials.
- Cases showed connections to Splashtop and Atera remote-management services; one involved large SSH Rclone data transfers to a rare external endpoint.
- Darktrace observed data exfiltration alongside file encryption in cases it says were likely double-extortion attacks; encrypted files in one case received a six-character alphanumeric extension.
- Darktrace says its alerts and Cyber AI Analyst incidents identified the activity, with its support and managed detection teams assisting affected clients.
Article Details
- Attack Vectors
- Phishing and social engineering to gain initial access.
- Network scanning, reverse DNS sweeps, and brute-force authentication activity.
- Possible entry through a Remote Desktop web server, followed by RDP connections used to pivot within the network.
- Use of remote management tools including Atera and Splashtop for remote access.
- Use of SMB scanning, SSH-based Rclone transfers, and data exfiltration alongside file encryption.
- Defensive Notes
- Monitor for unusual network scanning, reverse DNS sweeps, authentication attempts, and brute-force activity.
- Investigate unexpected Atera and Splashtop connections, unusual SSH transfers, and connections to rare external endpoints or ports.
- Look for file encryption with an appended six-character alphanumeric extension; Darktrace observed an example resembling “.293ac3”.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | agent-api[.]atera[.]com | Atera-linked domain contacted by a device during observed RansomHub-related activity. |
| DOMAIN | ps[.]atera[.]com | Listed by the article as an indicator of compromise associated with RansomHub incidents. |
| HOSTNAME | st-v3-univ-srs-win-3720[.]api[.]splashtop[.]com | Listed by the article as an indicator of compromise associated with RansomHub incidents. |
| IPV4 | 108[.]157[.]150[.]120 | Listed by the article as an indicator of compromise associated with RansomHub incidents. |
| IPV4 | 20[.]37[.]139[.]187 | External endpoint observed alongside a connection to agent-api[.]atera[.]com and linked in the article to Atera. |
| IPV4 | 38[.]244[.]145[.]85 | Rare external endpoint used to transfer a large volume of data over SSH Rclone. |
MITRE ATT&CK
T1001 · Data ObfuscationThe article maps observed activity to this technique.T1018 · Remote System DiscoveryThe article maps observed activity to this technique.T1041 · Exfiltration Over C2 ChannelData exfiltration was observed, including a large SSH Rclone transfer to a rare external endpoint.T1046 · Network Service DiscoveryAttackers performed network scanning and SMB scans against devices.T1083 · File and Directory DiscoveryThe article maps observed activity to this technique.T1110 · Brute ForceAttackers performed brute-force activity and multiple authentication attempts while seeking valid credentials.T1135 · Network Share DiscoveryThe article maps observed activity to this technique.T1190 · Exploit Public-Facing ApplicationThe article maps initial access to this technique; it says entry through a Remote Desktop web server is plausible, not confirmed.T1210 · Exploitation of Remote ServicesThe article maps lateral movement to this technique after attackers gained access to compromised networks.T1567.002 · Exfiltration to Cloud StorageThe article maps observed activity to this sub-technique.T1592.004 · Client ConfigurationsThe article maps the observed reconnaissance activity to this sub-technique.T1595.002 · Vulnerability ScanningThe article maps scanning activity to this sub-technique.
People
Threat Actors
RansomHubRansomware group and RaaS platform whose affiliates were associated with the attacks described.ScatteredSpiderThe article says the group transitioned from ALPHV-aligned operations to RansomHub-aligned operations.ShadowSyndicateIdentified in the article as a threat group that used RansomHub.
Malware
BlackCatOne notable threat group to have transitioned from ALPHV (BlackCat)-aligned operations to RansomHub-aligned operations is ScatteredSpider [1]. The adoption of RansomHub by ScatteredSpider and other threat actorsRansomHubIn a previous Inside the SOC blog, Darktrace investigated RansomHub and its growing impact on the threat landscape due to its use by the ShadowSyndicate threat group. Here, RansomHub is revisited with new insights on
Vendors
Products
AteraIn more recent RansomHub attacks, tools such as Atera and Splashtop have been used to facilitate remote access, while NetScan has been employed to discover and retrieve information about network devices [7].ESXito maintain control over compromised networks and exploit vulnerabilities in systems like Windows, Linux, ESXI, and NAS.Linuxthe healthcare sector [4]. They use ransomware variants rewritten in GoLang to target both Windows and Linux systems [5]. RansomHub is known for employing double extortion attacks, encrypting data using “Curve25519”Microsoft Windowsservices, and the healthcare sector [4]. They use ransomware variants rewritten in GoLang to target both Windows and Linux systems [5]. RansomHub is known for employing double extortion attacks, encrypting data usingNAScontrol over compromised networks and exploit vulnerabilities in systems like Windows, Linux, ESXI, and NAS.SplashtopIn more recent RansomHub attacks, tools such as Atera and Splashtop have been used to facilitate remote access, while NetScan has been employed to discover and retrieve information about network devices [7].
Tools
netscanIn more recent RansomHub attacks, tools such as Atera and Splashtop have been used to facilitate remote access, while NetScan has been employed to discover and retrieve information about network devices [7].NgrokNgrok: A legitimate reverse proxy tool that creates a secure tunnel to servers located behind firewalls, used by the group for lateral movement and data exfiltration.RClonethe alerted device. Following this, the same device was observed sending a large volume of data over SSH Rclone to a rare external endpoint on the unusual port 448, triggered multiple models in Darktrace / NETWORK.RemminaRemmina: An open-source remote desktop client for POSIX-based operating systems, enabling threat actors to access remote services [1].SecretServerSecretStealerSecretServerSecretStealer: A PowerShell script that allows for the decryption of passwords [1].
Industries
Critical infrastructureThe RansomHub ransomware group has been observed targeting various sectors, including critical infrastructure, financial and government services, and the healthcare sector [4]. They use ransomware variants rewritten inFinancial ServicesGovernmentgroup has been observed targeting various sectors, including critical infrastructure, financial and government services, and the healthcare sector [4]. They use ransomware variants rewritten in GoLang to targetHealthcareALPHV was a RaaS strain used by cybercriminals to breach Change Healthcare in February 2024 [2]. However, there are claims that the ransom payment never reached the affiliate using ALPHV, leading to a loss of trust in