# RansomHub ransomware exploits CVE-2023-3519, CVE-2023-27997, CVE-2023-46604

Published: 2025-07-14 · Severity: high · Sectors: defense, government-national, healthcare, financial-services, energy, transportation, telecommunications, infrastructure, manufacturing, technology, education
Canonical: https://vorant.io/reports/604234cc-3e87-5b32-9480-3307d0b51524/ransomhub-ransomware-exploits-cve-2023-3519-cve-2023-27997-cve-2023-46604

> RansomHub ransomware-as-a-service has compromised 210 victims across critical infrastructure using known CVEs and double extortion.

RansomHub is a ransomware-as-a-service variant that emerged in February 2024, formerly known as Cyclops and Knight. It has established itself as an efficient service model, recently attracting high-profile affiliates from LockBit and ALPHV. Since inception, RansomHub has encrypted and exfiltrated data from at least 210 victims representing water and wastewater, information technology, government services, healthcare, emergency services, food and agriculture, financial services, commercial facilities, critical manufacturing, transportation, and communications sectors.

Affiliates gain initial access through phishing, exploitation of known vulnerabilities (CVE-2023-3519, CVE-2023-27997, CVE-2023-46604, CVE-2023-22515, CVE-2023-46747, CVE-2023-48788, CVE-2017-0144, CVE-2020-1472, CVE-2020-0787), and password spraying. Once inside, they conduct network scanning, establish persistence through user account creation, escalate privileges using Mimikatz, and move laterally via RDP, PsExec, AnyDesk, and Cobalt Strike. Data exfiltration occurs via AWS S3, PuTTY, WinSCP, Rclone, or C2 tools. Encryption uses Curve 25519 with victim-specific key pairs, implementing intermittent encryption in 0x100000-byte chunks. Ransom notes direct victims to Tor-based negotiation URLs with payment deadlines of 3-90 days before data publication on the leak site.

## Mentioned in this report

- Vulnerabilities: CVE-2017-0144 (KEV), CVE-2020-0787 (KEV), CVE-2020-1472 (KEV), CVE-2023-22515 (KEV), CVE-2023-27997 (KEV), CVE-2023-3519 (KEV), CVE-2023-46604 (KEV), CVE-2023-46747 (KEV), CVE-2023-48788 (KEV)
- Threat actors: RansomHub
- Malware: RansomHub

## Detection guidance (public sample)

### Shadow Copy Deletion or Recovery Inhibition Commands

ATT&CK: T1490

Detects vssadmin, wmic, wbadmin or bcdedit commands that delete shadow copies or backups, or disable recovery, as run before ransomware encryption such as RansomHub. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Shadow Copy Deletion or Recovery Inhibition Commands
description: Detects commands that delete volume shadow copies or backup catalogs,
  or disable Windows recovery, as run by ransomware affiliates before encryption.
  Matches on the command pattern, not a specific binary hash.
tags:
- attack.impact
- attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection_vssadmin:
    Image|endswith: \vssadmin.exe
    CommandLine|contains|all:
    - delete
    - shadows
  selection_wmic:
    Image|endswith: \wmic.exe
    CommandLine|contains|all:
    - shadowcopy
    - delete
  selection_wbadmin:
    Image|endswith: \wbadmin.exe
    CommandLine|contains|all:
    - delete
    - catalog
  selection_bcdedit:
    Image|endswith: \bcdedit.exe
    CommandLine|contains|all:
    - recoveryenabled
    - 'no'
  condition: 1 of selection_*
falsepositives:
- Backup or storage administrators intentionally purging shadow copies to reclaim
  disk space
- Disk imaging or system-preparation scripts that disable recovery
level: high
id: 5d16a268-9466-529c-896b-16a4e58ceed6
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-242a
```

### Rclone Execution for Data Transfer

ATT&CK: T1537

Detects rclone (including renamed copies identified via original filename) running copy, sync or move operations, as used by ransomware affiliates to exfiltrate data to cloud storage. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Rclone Execution for Data Transfer
description: Detects rclone, identified by image name or PE original filename so renamed
  copies are caught, running copy/sync/move operations. RansomHub affiliates use Rclone,
  among other tools, to exfiltrate data before encryption.
tags:
- attack.exfiltration
- attack.t1537
- attack.t1048.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_tool:
  - Image|endswith: \rclone.exe
  - OriginalFileName: rclone.exe
  selection_action:
    CommandLine|contains:
    - ' copy '
    - ' sync '
    - ' move '
    - ' copyto '
  condition: selection_tool and selection_action
falsepositives:
- Administrators using rclone for sanctioned backup or cloud migration jobs
- Developers syncing build artefacts to cloud storage
level: high
id: d7eab203-5269-5404-9b5f-0076096ad3a8
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-242a
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-242a

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/604234cc-3e87-5b32-9480-3307d0b51524/ransomhub-ransomware-exploits-cve-2023-3519-cve-2023-27997-cve-2023-46604.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup