RansomHub ransomware exploits CVE-2023-3519, CVE-2023-27997, CVE-2023-46604
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
RansomHub ransomware-as-a-service has compromised 210 victims across critical infrastructure using known CVEs and double extortion.
RansomHub is a ransomware-as-a-service variant that emerged in February 2024, formerly known as Cyclops and Knight. It has established itself as an efficient service model, recently attracting high-profile affiliates from LockBit and ALPHV. Since inception, RansomHub has encrypted and exfiltrated data from at least 210 victims representing water and wastewater, information technology, government services, healthcare, emergency services, food and agriculture, financial services, commercial facilities, critical manufacturing, transportation, and communications sectors.
Affiliates gain initial access through phishing, exploitation of known vulnerabilities (CVE-2023-3519, CVE-2023-27997, CVE-2023-46604, CVE-2023-22515, CVE-2023-46747, CVE-2023-48788, CVE-2017-0144, CVE-2020-1472, CVE-2020-0787), and password spraying. Once inside, they conduct network scanning, establish persistence through user account creation, escalate privileges using Mimikatz, and move laterally via RDP, PsExec, AnyDesk, and Cobalt Strike. Data exfiltration occurs via AWS S3, PuTTY, WinSCP, Rclone, or C2 tools. Encryption uses Curve 25519 with victim-specific key pairs, implementing intermittent encryption in 0x100000-byte chunks. Ransom notes direct victims to Tor-based negotiation URLs with payment deadlines of 3-90 days before data publication on the leak site.
Mentioned in this report
Detection guidance
Shadow Copy Deletion or Recovery Inhibition Commands
Detects vssadmin, wmic, wbadmin or bcdedit commands that delete shadow copies or backups, or disable recovery, as run before ransomware encryption such as RansomHub. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Shadow Copy Deletion or Recovery Inhibition Commands
description: Detects commands that delete volume shadow copies or backup catalogs,
or disable Windows recovery, as run by ransomware affiliates before encryption.
Matches on the command pattern, not a specific binary hash.
tags:
- attack.impact
- attack.t1490
logsource:
category: process_creation
product: windows
detection:
selection_vssadmin:
Image|endswith: \vssadmin.exe
CommandLine|contains|all:
- delete
- shadows
selection_wmic:
Image|endswith: \wmic.exe
CommandLine|contains|all:
- shadowcopy
- delete
selection_wbadmin:
Image|endswith: \wbadmin.exe
CommandLine|contains|all:
- delete
- catalog
selection_bcdedit:
Image|endswith: \bcdedit.exe
CommandLine|contains|all:
- recoveryenabled
- 'no'
condition: 1 of selection_*
falsepositives:
- Backup or storage administrators intentionally purging shadow copies to reclaim
disk space
- Disk imaging or system-preparation scripts that disable recovery
level: high
id: 5d16a268-9466-529c-896b-16a4e58ceed6
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-242a
Rclone Execution for Data Transfer
Detects rclone (including renamed copies identified via original filename) running copy, sync or move operations, as used by ransomware affiliates to exfiltrate data to cloud storage. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Rclone Execution for Data Transfer
description: Detects rclone, identified by image name or PE original filename so renamed
copies are caught, running copy/sync/move operations. RansomHub affiliates use Rclone,
among other tools, to exfiltrate data before encryption.
tags:
- attack.exfiltration
- attack.t1537
- attack.t1048.002
logsource:
category: process_creation
product: windows
detection:
selection_tool:
- Image|endswith: \rclone.exe
- OriginalFileName: rclone.exe
selection_action:
CommandLine|contains:
- ' copy '
- ' sync '
- ' move '
- ' copyto '
condition: selection_tool and selection_action
falsepositives:
- Administrators using rclone for sanctioned backup or cloud migration jobs
- Developers syncing build artefacts to cloud storage
level: high
id: d7eab203-5269-5404-9b5f-0076096ad3a8
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-242a
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-242a
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs