Threat Actor Unknown origin
RansomHub
RansomHub is a rapidly growing ransomware group believed to be an updated version of the older Knight ransomware. They have been linked to attacks exploiting the Zerologon vulnerability to gain initial access. RansomHub has attracted former affiliates of the ALPHV ransomware group and operates as a Ransomware-as-a-Service with a unique affiliate prepayment model. The group has been active in extorting victims and leaking sensitive data to pressure for ransom payments.
MITRE ATT&CK TTPs 15
T1053 T1078 T1082 T1083 T1098 T1110 T1133 T1190 T1210 T1222 T1486 T1490 T1566 T1573 T1588
Scheduled Task/Job
Execution
Valid Accounts
Defense Evasion
System Information Discovery
Discovery
File and Directory Discovery
Discovery
Account Manipulation
Persistence
Brute Force
Credential Access
External Remote Services
Persistence
Exploit Public-Facing Application
Initial Access
Exploitation of Remote Services
Lateral Movement
File and Directory Permissions Modification
Defense Evasion
Data Encrypted for Impact
Impact
Inhibit System Recovery
Impact
Phishing
Initial Access
Encrypted Channel
Command And Control
Obtain Capabilities
Resource Development
Source Articles
DevMan RaaS Portal Centralizes Payload Builds, Victim Management, and Affiliate Payouts
DevMan, a ransomware-as-a-service (RaaS) operation also tracked as Funky Mantis, operates a centralized affiliate portal enabling payload generation, victim management, and payout coordination. The group evolved from affiliations with Qilin, DragonForce, and others, maintaining strong technical similarities to DragonForce ransomware. DevMan promotes attacks on critical infrastructure, including a specialized SCADA-targeting locker designed to cause physical system damage. The operation enforces strict governance over affiliates, uses an 80-20 revenue split, and has claimed 184 victims, primarily in the U.S. across technology, healthcare, and government sectors.
hacker-news ·3w ago
Inside the Modern SOC: The 72-Minute Race
The article highlights the increasing speed of cyberattacks, with adversaries achieving data exfiltration in as little as 72 minutes. Attackers leverage compromised credentials and identity-based techniques to rapidly escalate privileges and move laterally across environments. Modern SOCs struggle to keep pace due to manual processes and fragmented workflows. Threat actors like Muddled Libra and Spoiled Scorpius are exemplifying this trend by exploiting identity weaknesses to accelerate attack timelines.
unit42 ·2mo ago