Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · RansomHub · Unknown · misp-galaxy · refreshed 2026-10-06

RansomHub

sigil · no ATT&CK coverage stated

What changed

ledger · newest first
  1. —todaynew CVE1 new CVE: CVE-2020-1472

Analyst brief

misp-galaxy

RansomHub is a rapidly growing ransomware group believed to be an updated version of the older Knight ransomware. They have been linked to attacks exploiting the Zerologon vulnerability to gain initial access. RansomHub has attracted former affiliates of the ALPHV ransomware group and operates as a Ransomware-as-a-Service with a unique affiliate prepayment model. The group has been active in extorting victims and leaking sensitive data to pressure for ransom payments.

CVEs RansomHub is cited as exploiting

none on KEV
  1. CVE-2020-14722026-10-17
    1. “In recent RansomHub attacks investigated by Symantec, the attackers gained initial access by exploiting the Zerologon vulnerability ( CVE-2020-1472 ), which can allow an attacker to gain domain administrator privileges and take control of the entire domain.”

      cited as exploiting · source: symantec-enterprise-blogs.security.com ↗ · 2026-10-17

    2. “The RansomHub ransomware’s attack chain includes exploiting the Zerologon vulnerability (CVE-2020-1472).”

      cited as exploiting · source: trendmicro.com ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Take it with you

keyless · no signup

References

3 sources
  1. 1.symantec-enterprise-blogs.security.com/threat-intelligence/ransomhub-knight-ransomware
  2. 2.forescoutstage.wpengine.com/blog/analysis-a-new-ransomware-group-emerges-from-the-…
  3. 3.sentinelone.com/blog/ransomware-evolution-how-cheated-affiliates-are-r…

Track RansomHub on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.