RansomHub ransomware

RansomHub is an affiliate-based ransomware brand that encrypted Windows, Linux and ESXi systems from February 2024 until its infrastructure went dark around the start of April 2025. Encrypted files get a random six-character extension, and the matching note is usually README_ plus those same six characters and .txt; a How To Restore Your Files.txt note is also recorded. The note opens with Hello! Visit our Blog, says data was stolen and encrypted, and points to a Tor chat where the victim logs in with a client ID. Affiliates broke in through phishing, password spraying and exploits for edge devices such as Citrix NetScaler and FortiOS, then removed defences, deleted shadow copies and copied data out with tools like Rclone and WinSCP before encrypting in intermittent chunks with Curve25519-based keys. Government reporting treats RansomHub as the successor of Knight, itself the rebrand of Cyclops, and many affiliates drifted to rival programmes after the shutdown.

Ransom note filenames: How To Restore Your Files.txt

Decryptor: No public decryptor was found. Checked 2026-10-28.

Data exfiltration risk: Confirmed — The FBI and CISA advisory reports affiliates exfiltrating data with Rclone, WinSCP, cloud transfers and HTTP POST before encryption, then publishing it on the RansomHub leak site.

Systems typically targeted: Windows and Linux servers, VMware ESXi hosts

Do this first: Patch or take offline any exposed Citrix NetScaler and FortiOS SSL-VPN appliances and hunt for Rclone or WinSCP transfers before restoring from backups.