CISA and Partners Issue Advisory on RansomHub Ransomware Threat

On August 29, 2024, the Cybersecurity and Infrastructure Security Agency (CISA), in collaboration with the FBI, the Multi-State Information Sharing and Analysis Center (MS-ISAC), and the Department of Health and Human Services (HHS), released a joint cybersecurity advisory focusing on a new ransomware threat called RansomHub. This ransomware variant, previously known as Cyclops and Knight, has recently gained significant attention, particularly due to the involvement of affiliates from other notorious ransomware groups like LockBit and ALPHV.

The advisory, part of the #StopRansomware initiative, offers critical insights for network defenders, providing detailed indicators of compromise (IOCs), tactics, techniques, and procedures (TTPs), as well as detection methods that have been identified through ongoing FBI investigations and third-party reporting as of August 2024. RansomHub operates under a ransomware-as-a-service model, making it accessible to various cybercriminals and increasing its threat potential across different sectors.

CISA strongly urges network defenders to review the advisory and implement the recommended mitigations to protect their systems from RansomHub and similar threats. The advisory also directs network defenders to the broader #StopRansomware Guide for additional strategies on ransomware protection, detection, and response.

Moreover, CISA emphasizes the importance of secure-by-design principles for software manufacturers, encouraging them to take an active role in enhancing the security of their products. By applying these principles, manufacturers can help shift the cybersecurity risk balance, making systems more resilient to threats like RansomHub. More information on secure-by-design approaches can be found on CISA’s dedicated webpage, which also features a joint guide titled “Shifting the Balance of Cybersecurity Risk: Principles and Approaches for Secure by Design Software.”

This advisory highlights the ongoing evolution of ransomware threats and the necessity for proactive and collaborative cybersecurity measures to mitigate the risks posed by sophisticated cybercriminal activities.