An infection with RansomHub is marked by your systems showing a notification similar to the one shown here. This indicates that a specialised cybercrime group has compromised your systems and is holding both your data and access hostage, demanding payment of a ransom, typically in cryptocurrency like Bitcoin.
If you arrived at your offices to find someone had broken in, your initial response would be to call the police and refrain from touching anything, understanding that this could contaminate the crime scene.
A cyber-attack demands the same approach. You must leave the environment untouched as a forensic investigation, conducted by Digital forensic specialists will need to take place. This is not a job for your IT team or MSP.
In February 2024, a new ransomware group known as RansomHub erupted onto the ransomware scene, initially targeting an organisation in Brazil and since claiming attacks on another 17 victims globally. The group profess to following a moral code of sorts, stating that they do not attack non-profit organisations or re-target previous victims.
Unlike most ransomware groups, RansomHub claims to be made up of a network of global entities, although analysis of its operations show close resemblances to the Russian ransomware setup. The group advertise its collaboration with affiliates, which suggests they are operating a Ransomware-as-a-Service (RaaS) model - citing fast encryption as a distinguishing feature. The ransomware developed by the group is written in Golang and C++, and can target Windows, Linux, and ESXi systems.
RansomHub use double extortion tactics which entails encrypting a victim's data, rendering it inaccessible, and then exfiltrating sensitive information, such as personal or company data. The threat actors demand payment for decrypting the files and preventing the release of the data on the dark web.
This dual threat significantly intensifies pressure on the victim to pay the ransom, even if they have backups, due to the potential data exposure, which can result in reputational damage and legal consequences. This tactic has gained popularity among cybercriminals as it increases their chances of receiving payment.
Although RansomHub emerged in its current form in early 2024, the group is likely a reincarnation of an earlier, disbanded group making its age difficult to gauge.
To date, RansomHub has claimed 614 victims.
Solace Cyber’s track record includes hundreds of successful response recoveries, providing Digital Forensic Incident Response services, 24x7x365.
“The number of active ransomware groups more than doubled year-over-year, increasing 55% from 29 distinct groups in Q1 2023 to 45 distinct groups in Q1 2024.”
Read more...
Solace Global was founded in 2010 as global experts in risk management and security, offering services such as Travel, Crisis, and Offshore Risk Management. With a 24/7 Security Operations Centre and an in-house intelligence team providing daily and weekly reports, Solace Global is accredited to ISO 27001, 14001, 45001, and 9001 standards.
Solace Cyber was established in 2021, specialising in Cyber breaches, particularly Digital Forensics and Incident Response, Ransomware, Risk Management, and Information Security, along with Managed Security Services. The leadership team collectively possess over 20 years of experience in the IT and security industry.
Solace Cyber is accredited to ISO 27001 and in 2022 gained the prestigious Cyber Incident Response (Level 2) accreditation with the National Cyber Security Centre in 2022. This accreditation represents the UK’s highest cyber security standards, providing top-tier incident response support and recovery.
s
%+
A forensic analysis needs to be meticulous. A clean restore and recovery requires a wealth of experience not normally available in an in-house team who must provide a broader range of IT support skills:
Solace Cyber was established precisely for this scenario. We have a well-defined process for handling cyber-attacks like RansomHub, which involves a 6-step approach:
It includes a thorough digital forensic analysis from step 2 where the output becomes a central component of business recovery. This is because understanding the attack is of critical importance:
It is critical that the analysis of digital evidence is carried out to an agreed plan. This will have been designed to provide the best and earliest chance of discovering a root cause, which is essential to inform remediation/eradication and recovery as well as supporting a legal take-down case if this is applicable. A legal take-down means we can assist in the legal enforcement that stops the criminals from publishing the data, thus undermining the ransom notice.
Solace Cyber’s Digital Forensic and Incident Response teams maintain consistent communication throughout. Dedicated Incident Managers and technical engineering leads provide updates during the Cyber Incident Response journey, utilising risk registers and working within change management processes, all from triage through to post-incident delivering successful business recovery.
Solace Cybers’ support continues beyond the recovery process. Once your business is back up and running, we work with you to transform your cyber security through a threat-informed approach utilising our Solace Global - Cyber 9 Step Process.
Yes. RansomHub employs a Ransomware-as-a-Service (RaaS) model. Interestingly though, RansomHub offers its affiliates “guidelines” to follow that outline the importance of conscientiousness. The group requires affiliates to adhere to the agreements and requirements established during negotiations, otherwise the collaboration will be terminated.
The RansomHub ransomware entered your system by:
We recommend you adopt policies to:
After recovering from a RansomHub ransom attack, Solace Cyber recommends that you update your business continuity plan to account for lessons learnt during this attack & recovery.
Most ransomware breaches cost approx. £500K with smaller email data breaches in the realm of £50K. There is a dichotomy of preserving the environment for forensics or recovering it quickly for less business interruption. The cost increases the longer it takes to identify the breach and resolve it.
A Cyber Security insurance claim is complex and includes reasonable expenses to investigate and remediate an incident along with cover for legal, business interruption, criminal liability, employment liability and ransom policies. The insurance industry is liable to deliver the business recovery BUT Cyber insurance is viewed as volatile within the industry and many insurance policies are not being validated correctly.
Navigating through this requires expertise, which is where Solace Cyber can help.
Law enforcement discourages paying ransom demands. If you do choose to pay, there's no guarantee you will regain access to your data or prevent it from being shared on the dark web. In a new trend, ransomware affiliates are actively monetising stolen data outside of their original RaaS agreements.
The NCSC have documented the deliberations for paying ransomware: https://www.ncsc.gov.uk/ransomware/home
Important Reminder: It is a criminal offense to pay money to people who are subject to financial sanctions. The list of who is subject to financial sanctions is constantly changing.
The latest iteration can be found here: https://www.gov.uk/government/publications/financial-sanctions-consolidated-list-of-targets
Most likely, yes. Some of the lost data might be classified as "Personal Data" for your customers which you are legally obligated to protect. As a ransom attack means this data may have been lost, you hold a legal and moral duty to inform your customers. You also need to inform the Information Commissioner's Office (ICO) at https://ico.org.uk/.
Thankfully your insurer or legal counsel will be able to guide you on what steps to take and how to proceed. Alternatively, Solace has expertise in collaborating with insurers and lawyers and can aid in handling this relationship during this challenging period.
A ransomware attack poses the biggest threat to your business by:
In the event of a business interruption, identifying your position in the supply chain for any specific item can be challenging. Continuing and sustaining operations may also become difficult. If the interruption is prolonged, operational output will be affected. Even after systems and data are restored, reconciling the work done during the downtime will be challenging and require careful planning for future tasks.
This is why Ransomware is second only to receivership for debilitating a business.
The NCSC is the UK National Cyber Security Centre. They provide cyber security guidance and support, helping to make the UK the safest place to live and work online. They have defined a Cyber Incident Response procedure and they have approved and accredited suppliers to provide this service.
As a recognised Assured Service Provider by the National Cyber Security Centre (NCSC), Solace Cyber provide comprehensive cyber risk management services that are designed to Protect, Detect & Mitigate cyber security threats across the UK.
Action Fraud is the UK's national reporting centre for fraud and cybercrime. Whether you have been scammed, defrauded, or experienced cybercrime in England, Wales, or Northern Ireland, Action Fraud offers a central point of contact for information on fraud and financially motivated cybercrime.
If your systems are showing signs of a RansomHub attack, REMAIN CALM.
YOU MUST NOT TOUCH THEM, RESTORE OR OVERWRITE THE DATA (explanation above).
Contact Solace Cyber on 01202 308818 or complete our form for a call back from one of our experts.
We will act promptly to reduce your business downtime.
Solace Cyber, part of Solace Global, helps companies across the UK recover from ransomware attacks and data breaches.
SOLACE GLOBAL CYBER LTD is registered in England & Wales no. 08830710
Solace Global
Twin Sails House,
W Quay Rd,
Poole, BH15 1JF
United Kingdom
