offered for sale on underground forums in February 2024 after Knight’s developers decided to shut down their operation. It is possible that other actors bought the Knight source code and updated it before launching RansomHub.
RansomHub and Knight compared
Both payloads are written in Go and most variants of each family are obfuscated with Gobfuscate. Only some early versions of Knight are not obfuscated.
The degree of code overlap between the two families is significant, making it very difficult to differentiate between them. In many cases, a determination could only be confirmed by checking the embedded link to the data leak site.
The two families have virtually identical help menus available on the command line. The sole difference is the addition of a sleep command in RansomHub.
restarts the affected computer in safe mode before encryption is Noberus Interestingly, the encryptor stores its configuration in a JSON where keywords match what was observed in RansomHub.
RansomHub attacks
In recent RansomHub attacks investigated by Symantec, the attackers gained initial access by exploiting the Zerologon vulnerability (CVE-2020-1472), which can allow an attacker to gain domain administrator privileges and take control of the entire domain.
The attackers used several dual-use tools before deploying the ransomware. Atera and Splashtop were used to facilitate remote access, while NetScan was used to likely discover and retrieve information about network devices. The RansomHub payload leveraged the iisreset.exe and iisrstas.exe command-line tools to stop all Internet Information Services (IIS) services.
Rapid growth
Despite only first appearing in February 2024, RansomHub has managed to grow very quickly and, over the past three months, was the fourth most prolific ransomware operator in terms of numbers of attacks publicly claimed. The group last week claimed responsibility for an attack on UK auction house Christies.
The speed at which RansomHub has established its business suggests that the group may consist of veteran operators with experience and contacts in the cyber underground.
For the latest protection updates, please visit the Symantec Protection Bulletin.
If an IOC is malicious and the file is available to us, Symantec Endpoint products will detect and block that file.