The RansomHub ransomware group has experienced a rapid rise in activity, quickly outpacing other cybercriminal groups. This emergence is attributed to the disruptions of LockBit and ALPHV. The group has been actively naming and shaming hundreds of organizations on its leak site, while also demanding exorbitant payments. RansomHub is suspected to be a rebrand of the Knight ransomware group.
A ransomware attack by RansomHub targeted the Mexican government platform Gob.mx, resulting in the theft of 313GB of data, including government contracts, insurance, and financial information. Attackers threatened to release the data to the dark web if a ransom wasn’t paid.