#### [Cyber-crime](/security/cyber_crime/)How cops taking down LockBit, ALPHV led to RansomHub’s meteoric rise====================================================================Cut off one head, two more grow back in its place————————————————-[Jessica Lyons](/Author/Jessica-Lyons ‘Read more by this author’) Sat 28 Dec 2024 // 12:34 UTC [](https://www.reddit.com/submit?url=https://www.theregister.com/2024/12/28/lockbit_alphv_disruptions_ransomhub_rise/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dreddit&title=How%20cops%20taking%20down%20LockBit%2c%20ALPHV%20led%20to%20RansomHub%27s%20meteoric%20rise) [](https://twitter.com/intent/tweet?text=How%20cops%20taking%20down%20LockBit%2c%20ALPHV%20led%20to%20RansomHub%27s%20meteoric%20rise&url=https://www.theregister.com/2024/12/28/lockbit_alphv_disruptions_ransomhub_rise/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dtwitter&via=theregister) [](https://www.facebook.com/dialog/feed?app_id=1404095453459035&display=popup&link=https://www.theregister.com/2024/12/28/lockbit_alphv_disruptions_ransomhub_rise/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dfacebook) [](https://www.linkedin.com/shareArticle?mini=true&url=https://www.theregister.com/2024/12/28/lockbit_alphv_disruptions_ransomhub_rise/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dlinkedin&title=How%20cops%20taking%20down%20LockBit%2c%20ALPHV%20led%20to%20RansomHub%27s%20meteoric%20rise&summary=Cut%20off%20one%20head%2c%20two%20more%20grow%20back%20in%20its%20place) [](https://api.whatsapp.com/send?text=https://www.theregister.com/2024/12/28/lockbit_alphv_disruptions_ransomhub_rise/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dwhatsapp) RansomHub, the ransomware collective that emerged earlier this year, quickly gained momentum, outpacing its criminal colleagues and hitting its victims especially hard. The group named and shamed hundreds of organizations on its leak site, while demanding exorbitant payments across various industries.The group, a [suspected Knight rebrand](https://www.theregister.com/2024/06/05/ransomhub_knight_reboot/), first appeared in February and quickly picked up out-of-work affiliates from [Lockbit](https://www.theregister.com/2024/05/22/lockbit_dethroned_as_leading_ransomware/) following that crew’s law enforcement [takedown](https://www.theregister.com/2024/05/07/alleged_lockbit_kingpin_charged_sanctioned/) around the same time. RansomHub also eagerly filled the void left by [ALPHV/BlackCat](https://www.theregister.com/2024/11/08/scattered_spider_blackcat_return/) after that group’s widely reported [exit scam](https://www.theregister.com/2024/03/08/change_healthcare_restores_first_system/) in March — bragging about recruiting affiliates from both defunct groups via TOX and cyber crime forums.By August, just six months after setting up shop, RansomHub had [claimed 210 victims](https://www.theregister.com/2024/08/30/ransomhub/) and drawn the attention of the FBI, CISA, and other government agencies gunning for cyber criminals. Its victims allegedly include [auction house Christie’s](https://www.theregister.com/2024/06/10/christies_clients_data_stolen/), [Frontier Communications](https://www.theregister.com/2024/06/07/frontier_communications_filing_cyberattack/), US pharmacy chain [Rite Aid](https://www.theregister.com/2024/07/16/rite_aid_says_22_million/), [Planned Parenthood](https://www.theregister.com/2024/09/04/planned_parenthood_cybersecurity_incident/), and [Delaware public libraries](https://www.theregister.com/2024/09/25/delaware_libraries_ransomware_attack/), among many others. Its brand of malware has since become the encryptor of choice for [Scattered Spider](https://www.theregister.com/2024/07/16/scattered_spider_ransom/) and other sophisticated criminals, and the gang posted a record-high 98 victims on its leak site in November. But, as other prolific digital thieves — including Scattered Spider — have learned, a string of high-profile attacks paints a [very large target](https://www.theregister.com/2024/11/21/scattered_spider_suspects/) on the group and its affiliates. While it’s much more difficult to apprehend ransomware crooks who are given safe harbor by Russian prosecutors, even [cyber criminals take holidays](https://www.theregister.com/2024/10/01/euro_cops_arrest_four_mystery) — and sometimes, the cops are waiting to make [arrests](https://www.theregister.com/2024/10/29/belgian_cops_arrest_two_suspected/) during those moments.### ‘Most active and significant’ ransomware threat’I don’t want to put RansomHub up on a pedestal. They are an opportunistic group,’ Michael McPherson, SVP of Security Operations at ReliaQuest, told *The Register*. ‘But they were smart to make this landgrab when they did. It will be interesting to see how long they can keep this run going.’During its brief tenure, the Russia-linked group has made a name for itself as ‘the current most active and significant threat in ransomware activity,’ according to an October 30 [report](https://www.reliaquest.com/blog/5-critical-threat-actors-you-need-to-know-about/) from ReliaQuest, which called the gang the most dominant ransomware group during the third quarter of 2024.’It’s an interesting group that did have a meteoric rise and almost seems to come out of nowhere,’ conceded McPherson, a former FBI special agent. ‘There was an obvious effort for RansomHub to gain affiliates. They’re very, I would say, generous in their model and advertising a 90–10 split.’ This means the affiliates who pull off the attack may keep 90 percent of the extortion payment while the ransomware operators receive 10 percent. An 80–20 or 70–30 split is more common among these crime crews, so the higher payout makes it easier for the new kids on the block to attract more workers.> It will be interesting to see how long they can keep this run going’These affiliates will go where the money is, and if somebody pays more, it would be silly not to go there,’ McPherson opined, adding that this business model ‘would feed RansomHub’s ability to go out and hit so many victims at once by having a large affiliate base.’Additionally, RansomHub’s operators on their dark web sites like to tout transparency with their affiliates — likely an effort to build trust with fellow criminals, following ALPHV’s alleged exit scam.’There’s marketing involved,’ McPherson observed. ‘They are reaching out to affiliates, trying to be more of a partner with them. They’re trying to evolve and take advantage of the cyber criminal landscape to grab market share. That’s what they want.’### Crew ‘moved fast and filled a void’Still, the group’s tactics are not unique, he noted. The group employs repurposed Knight code and double-extortion methods — which are used by most ransomware gangs today.This involves first breaking into their victims’ network and stealing valuable files, and then encrypting the data on the network, while also extorting the orgs for massive sums of money on dark web leak sites.’Their actual tactics are not unique, but their ability to move fast and fill a void is what makes them so noteworthy at this moment in time,’ McPherson told us. ‘Or maybe they’re just trying to run as hard and fast as they can, because they know they’re protected where they are.’ZeroFox analysts have also [tracked](https://www.zerofox.com/blog/ransomhub-extortion-attacks-on-sharp-upward-trajectory/) RansomHub’s rise this year, and reported the group accounted for about 2 percent of all attacks in Q1, 5.1 percent in Q2, 14.2 in Q3, and about 20 percent in Q4.> While it is almost certain that this will plateau, there is a likely chance that the collective will continue to attract experienced affiliates and remain the most dangerous threat’The greatest threat in early 2025 will very likely emanate from RansomHub,’ the security firm [declared](https://get.zerofox.com/rs/143-DHV-007/images/ZeroFox-2025-Key-Forecast-Report.pdf) -[PDF-] in a December 12 report that also called RansomHub ‘the most prominent R-&DE -[ransomware and data exfiltration-] outfit’ of 2024.’RansomHub’s attack tempo has been on a consistent upward trajectory, accounting for approximately 20 percent of all R-&DE incidents in Q4 2024,’ according to the report.’While it is almost certain that this will plateau, there is a likely chance that the collective will continue to attract experienced affiliates and remain the most dangerous R-&DE threat,’ it noted.’The way they’re conducting business, and the pace at which they’re exposing and publishing victims, is quite common with new ransomware groups,’ ZeroFox VP of Intelligence Adam Darrah told *The Register*. ‘It is likely RansomHub is made up of individuals affiliated with other now-defunct or waning-in-their-influence ransomware collectives. It is not uncommon for a newer shakedown mafia to come in and to make a splash.’* [RansomHub claims to net data hat-trick against Bologna FC](https://www.theregister.com/2024/11/30/bologna_fc_ransomhub/)* [RansomHub genius tries to put the squeeze on Delaware Libraries](https://www.theregister.com/2024/09/25/delaware_libraries_ransomware_attack/)* [RansomHub hits 210 victims in just 6 months](https://www.theregister.com/2024/08/30/ransomhub/)* [Scattered Spider, BlackCat claw their way back from criminal underground](https://www.theregister.com/2024/11/08/scattered_spider_blackcat_return/)The US presidential election this year also likely added to the increased attacks, added Darrah, a former CIA political analyst.’In the run up to a major US election, they -[were-] taking advantage of a community of defenders, both inside and outside the government, who are already on edge about cyber-based attacks,’ he said. ‘Ransomware groups that have any kind of official or unofficial affiliation with a nation-state intelligence service know that publishing such a high number of victims at an increased pace, at such an alarming rate, takes away time, attention, and resources from other defensive operations.’It’s important to note that the number of listed victims doesn’t directly equate to attacks. Victims that pay the ransom demand — or come to some sort of agreement with the criminals — may not ever see their org’s names on the criminals’ leak sites.’When they get on a radar this quickly, that also catches the attention of very capable good guys around the world,’ Darrah said. ‘So there’s a reason the life cycle of some of these groups is not long.’ZeroFox’s report warns that other ransomware gangs such as [Meow](https://www.theregister.com/2024/09/11/meow_ransomware_ops_revamp_more_attacks/), Play Ransomware, and [Hunters International](https://www.theregister.com/2024/09/11/hunters_ransom_icbc_london/) are ‘very likely’ to emerge as serious threats in early 2025. While it’s unknown how long RansomHub can keep up its run, one thing is clear: there’s no shortage of collectives waiting to take its place at the top of the charts. ® [Whitepaper: Top 5 Tips For Navigating Your SASE Journey](https://go.theregister.com/tl/2386/-14369/top-5-tips-for-navigating-your-sase-journey?td=wptl2386bt) Share [](https://www.reddit.com/submit?url=https://www.theregister.com/2024/12/28/lockbit_alphv_disruptions_ransomhub_rise/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dreddit&title=How%20cops%20taking%20down%20LockBit%2c%20ALPHV%20led%20to%20RansomHub%27s%20meteoric%20rise) [](https://twitter.com/intent/tweet?text=How%20cops%20taking%20down%20LockBit%2c%20ALPHV%20led%20to%20RansomHub%27s%20meteoric%20rise&url=https://www.theregister.com/2024/12/28/lockbit_alphv_disruptions_ransomhub_rise/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dtwitter&via=theregister) [](https://www.facebook.com/dialog/feed?app_id=1404095453459035&display=popup&link=https://www.theregister.com/2024/12/28/lockbit_alphv_disruptions_ransomhub_rise/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dfacebook) [](https://www.linkedin.com/shareArticle?mini=true&url=https://www.theregister.com/2024/12/28/lockbit_alphv_disruptions_ransomhub_rise/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dlinkedin&title=How%20cops%20taking%20down%20LockBit%2c%20ALPHV%20led%20to%20RansomHub%27s%20meteoric%20rise&summary=Cut%20off%20one%20head%2c%20two%20more%20grow%20back%20in%20its%20place) [](https://api.whatsapp.com/send?text=https://www.theregister.com/2024/12/28/lockbit_alphv_disruptions_ransomhub_rise/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dwhatsapp) #### More about* [Cybercrime](/Tag/Cybercrime/)* [Ransomware](/Tag/Ransomware/)* [Security](/Tag/Security/) More like these × ### More about* [Cybercrime](/Tag/Cybercrime/)* [Ransomware](/Tag/Ransomware/)* [Security](/Tag/Security/) ### Narrower topics* [2FA](/Tag/2FA/)* [Advanced persistent threat](/Tag/Advanced%20persistent%20threat/)* [Application Delivery Controller](/Tag/Application%20Delivery%20Controller/)* [Authentication](/Tag/Authentication/)* [BEC](/Tag/BEC/)* [Black Hat](/Tag/Black%20Hat/)* [BSides](/Tag/BSides/)* [Bug Bounty](/Tag/Bug%20Bounty/)* [CHERI](/Tag/CHERI/)* [CISO](/Tag/CISO/)* [Common Vulnerability Scoring System](/Tag/Common%20Vulnerability%20Scoring%20System/)* [Cybersecurity](/Tag/Cybersecurity/)* [Cybersecurity and Infrastructure Security Agency](/Tag/Cybersecurity%20and%20Infrastructure%20Security%20Agency/)* [Cybersecurity Information Sharing Act](/Tag/Cybersecurity%20Information%20Sharing%20Act/)* [Data Breach](/Tag/Data%20Breach/)* [Data Protection](/Tag/Data%20Protection/)* [Data Theft](/Tag/Data%20Theft/)* [DDoS](/Tag/DDoS/)* [DEF CON](/Tag/DEF%20CON/)* [Digital certificate](/Tag/Digital%20certificate/)* [Encryption](/Tag/Encryption/)* [Exploit](/Tag/Exploit/)* [Firewall](/Tag/Firewall/)* [Hacker](/Tag/Hacker/)* [Hacking](/Tag/Hacking/)* [Hacktivism](/Tag/Hacktivism/)* [Identity Theft](/Tag/Identity%20Theft/)* [Incident response](/Tag/Incident%20response/)* [Infosec](/Tag/Infosec/)* [Infrastructure Security](/Tag/Infrastructure%20Security/)* [Kenna Security](/Tag/Kenna%20Security/)* [NCSAM](/Tag/NCSAM/)* [NCSC](/Tag/NCSC/)* [Palo Alto Networks](/Tag/Palo%20Alto%20Networks/)* [Password](/Tag/Password/)* [Phishing](/Tag/Phishing/)* [Quantum key distribution](/Tag/Quantum%20key%20distribution/)* [Remote Access Trojan](/Tag/Remote%20Access%20Trojan/)* [REvil](/Tag/REvil/)* [RSA Conference](/Tag/RSA%20Conference/)* [Spamming](/Tag/Spamming/)* [Spyware](/Tag/Spyware/)* [Surveillance](/Tag/Surveillance/)* [TLS](/Tag/TLS/)* [Trojan](/Tag/Trojan/)* [Trusted Platform Module](/Tag/Trusted%20Platform%20Module/)* [Vulnerability](/Tag/Vulnerability/)* [Wannacry](/Tag/Wannacry/)* [Zero trust](/Tag/Zero%20trust/) #### More aboutShare [](https://www.reddit.com/submit?url=https://www.theregister.com/2024/12/28/lockbit_alphv_disruptions_ransomhub_rise/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dreddit&title=How%20cops%20taking%20down%20LockBit%2c%20ALPHV%20led%20to%20RansomHub%27s%20meteoric%20rise) [](https://twitter.com/intent/tweet?text=How%20cops%20taking%20down%20LockBit%2c%20ALPHV%20led%20to%20RansomHub%27s%20meteoric%20rise&url=https://www.theregister.com/2024/12/28/lockbit_alphv_disruptions_ransomhub_rise/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dtwitter&via=theregister) [](https://www.facebook.com/dialog/feed?app_id=1404095453459035&display=popup&link=https://www.theregister.com/2024/12/28/lockbit_alphv_disruptions_ransomhub_rise/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dfacebook) [](https://www.linkedin.com/shareArticle?mini=true&url=https://www.theregister.com/2024/12/28/lockbit_alphv_disruptions_ransomhub_rise/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dlinkedin&title=How%20cops%20taking%20down%20LockBit%2c%20ALPHV%20led%20to%20RansomHub%27s%20meteoric%20rise&summary=Cut%20off%20one%20head%2c%20two%20more%20grow%20back%20in%20its%20place) [](https://api.whatsapp.com/send?text=https://www.theregister.com/2024/12/28/lockbit_alphv_disruptions_ransomhub_rise/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dwhatsapp) POST A COMMENT #### More about* [Cybercrime](/Tag/Cybercrime/)* [Ransomware](/Tag/Ransomware/)* [Security](/Tag/Security/) More like these × ### More about* [Cybercrime](/Tag/Cybercrime/)* [Ransomware](/Tag/Ransomware/)* [Security](/Tag/Security/) ### Narrower topics* [2FA](/Tag/2FA/)* [Advanced persistent threat](/Tag/Advanced%20persistent%20threat/)* [Application Delivery Controller](/Tag/Application%20Delivery%20Controller/)* [Authentication](/Tag/Authentication/)* [BEC](/Tag/BEC/)* [Black Hat](/Tag/Black%20Hat/)* [BSides](/Tag/BSides/)* [Bug Bounty](/Tag/Bug%20Bounty/)* [CHERI](/Tag/CHERI/)* [CISO](/Tag/CISO/)* [Common Vulnerability Scoring System](/Tag/Common%20Vulnerability%20Scoring%20System/)* [Cybersecurity](/Tag/Cybersecurity/)* [Cybersecurity and Infrastructure Security Agency](/Tag/Cybersecurity%20and%20Infrastructure%20Security%20Agency/)* [Cybersecurity Information Sharing Act](/Tag/Cybersecurity%20Information%20Sharing%20Act/)* [Data Breach](/Tag/Data%20Breach/)* [Data Protection](/Tag/Data%20Protection/)* [Data Theft](/Tag/Data%20Theft/)* [DDoS](/Tag/DDoS/)* [DEF CON](/Tag/DEF%20CON/)* [Digital certificate](/Tag/Digital%20certificate/)* [Encryption](/Tag/Encryption/)* [Exploit](/Tag/Exploit/)* [Firewall](/Tag/Firewall/)* [Hacker](/Tag/Hacker/)* [Hacking](/Tag/Hacking/)* [Hacktivism](/Tag/Hacktivism/)* [Identity Theft](/Tag/Identity%20Theft/)* [Incident response](/Tag/Incident%20response/)* [Infosec](/Tag/Infosec/)* [Infrastructure Security](/Tag/Infrastructure%20Security/)* [Kenna Security](/Tag/Kenna%20Security/)* [NCSAM](/Tag/NCSAM/)* [NCSC](/Tag/NCSC/)* [Palo Alto Networks](/Tag/Palo%20Alto%20Networks/)* [Password](/Tag/Password/)* [Phishing](/Tag/Phishing/)* [Quantum key distribution](/Tag/Quantum%20key%20distribution/)* [Remote Access Trojan](/Tag/Remote%20Access%20Trojan/)* [REvil](/Tag/REvil/)* [RSA Conference](/Tag/RSA%20Conference/)* [Spamming](/Tag/Spamming/)* [Spyware](/Tag/Spyware/)* [Surveillance](/Tag/Surveillance/)* [TLS](/Tag/TLS/)* [Trojan](/Tag/Trojan/)* [Trusted Platform Module](/Tag/Trusted%20Platform%20Module/)* [Vulnerability](/Tag/Vulnerability/)* [Wannacry](/Tag/Wannacry/)* [Zero trust](/Tag/Zero%20trust/) #### TIP US OFF[Send us news](https://www.theregister.com/Profile/contact/)[#### Ransomware scum blow holes in Cleo software patches, Cl0p (sort of) claims responsibilityBut can you really take crims at their word?Security12 days -| 1](/2024/12/16/ransomware_attacks_exploit_cleo_bug/?td=keepreading) [#### Suspected LockBit dev, facing US extradition, ‘did it for the money’Dual Russian-Israeli national arrested in AugustCyber-crime5 days -| 17](/2024/12/23/lockbit_ransomware_dev_extradition/?td=keepreading) [#### What do ransomware and Jesus have in common? A birth month and an unwillingness to dieFeature 35 years since AIDS first borked a PC and we’re still no closer to a solutionCyber-crime4 days -| 20](/2024/12/24/ransomware_in_2024/?td=keepreading) [#### Fortify your dataHow cyber resilient storage hardware can defeat ransomwareSponsored Feature](/2024/11/26/fortify_your_data/?td=keepreading) [#### How Androxgh0st rose from Mozi’s ashes to become ‘most prevalent malware’Botnet’s operators ‘driven by similar interests as that of the Chinese state’Cyber-crime4 days -| 1](/2024/12/24/androxgh0st_botnet_mozi/?td=keepreading) [#### Deloitte says cyberattack on Rhode Island benefits portal carries ‘major security threat’Personal and financial data probably stolenCyber-crime12 days -| 2](/2024/12/16/deloitte_rhode_island_attack/?td=keepreading) [#### Critical security hole in Apache Struts under exploitYou applied the patch that could stop possible RCE attacks last week, right?Patches11 days -| 4](/2024/12/17/critical_rce_apache_struts/?td=keepreading) [#### Don’t fall for a mail asking for rapid Docusign action — it may be an Azure account hijack phishRecent campaign targeted 20,000 folk across UK and Europe with this tactic, Unit 42 warnsCyber-crime10 days -| 17](/2024/12/19/docusign_lure_azure_account_takeover/?td=keepreading) [#### Phishers cast wide net with spoofed Google Calendar invitesNot that you needed another reason to enable the ‘known senders’ settingCyber-crime11 days -| 17](/2024/12/18/google_calendar_spoofed_in_phishing_campaign/?td=keepreading) [#### Iran-linked crew used custom ‘cyberweapon’ in US critical infrastructure attacksIOCONTROL targets IoT and OT devices from a ton of makers, apparentlyResearch15 days -| 15](/2024/12/13/iran_cyberweapon_us_attacks/?td=keepreading) [#### US names Chinese national it alleges was behind 2020 attack on Sophos firewallsAlso sanctions his employer — an outfit called Sichuan Silence linked to Ragnarok ransomwareCyber-crime18 days -| 4](/2024/12/11/sichuan_silence_sophos_zeroday_sanctions/?td=keepreading) [#### UK ICO not happy with Google’s plans to allow device fingerprintingin brief Also, Ascension notifies 5.6M victims, Krispy Kreme bandits come forward, LockBit 4.0 released, and moreSecurity5 days -| 75](/2024/12/23/uk_ico_not_happy_with/?td=keepreading)
Related Tags:
Play
Storm-0875
Octo Tempest
NAICS: 445 – Food And Beverage Retailers
NAICS: 44 – Retail Trade – Auto
Food
Home
NAICS: 519 – Web Search Portals
Libraries
Archives
Other Information Services
NAICS: 517 – Telecommunications
NAICS: 62 – Health Care And Social Assistance
NAICS: 623 – Nursing And Residential Care Facilities
Associated Indicators: