Security Resilience

Threat actor · all actors

RansomHubMISP-9d218bb3 criminal

aka RansomHub

Last updated: 2026-10-16

9attributed CVEs
0ATT&CK techniques
22.6IDF score (tooling uniqueness)
0exclusive CVEs
2017–2024years active

About this actor

RansomHub is a rapidly growing ransomware group believed to be an updated version of the older Knight ransomware. They have been linked to attacks exploiting the Zerologon vulnerability to gain initial access. RansomHub has attracted former affiliates of the ALPHV ransomware group and operates as a Ransomware-as-a-Service with a unique affiliate prepayment model. The group has been active in extorting victims and leaking sensitive data to pressure for ransom payments.

How we know this

Data origin
MISP threat-actor galaxy Imported from the open-source MISP threat-actor galaxy.
Techniques
No ATT&CK techniques mapped.
Named victims
None on file.

Thin data: No ATT&CK techniques are mapped yet — the behavioural profile is empty.

See how actor data is built for the full pipeline.

Activity timeline

2017: 1 CVE published120172020: 2 CVE published220202021: 1 KEV added120212022: 2 KEV added220222023: 5 CVE published2023: 5 KEV added1020232024: 1 CVE published2024: 1 KEV added22024
CVE publishedKEV added

Profile

CVERiskCVSSEPSSPublishedProducts
CVE-2023-46604 KEV10.010.00.99892023-10-27see CVE
CVE-2023-22515 KEV9.99.80.99702023-10-04see CVE
CVE-2023-27997 KEV9.99.80.92422023-06-13see CVE
CVE-2023-3519 KEV9.99.80.99752023-07-19see CVE
CVE-2023-46747 KEV9.99.80.97352023-10-26see CVE
CVE-2023-48788 KEV9.99.80.98532024-03-12see CVE
CVE-2017-0144 KEV9.28.80.99232017-03-17see CVE
CVE-2020-0787 KEV8.57.80.91412020-03-12see CVE
CVE-2020-1472 KEV7.55.50.99512020-08-17see CVE

No techniques attributed.

Co-occurring actors

Similar actors

Overlapping CVEs

Active in same years

Same category