
The New Ransomware Groups Shaking Up 2025
thehackernews.com
Mar 03, 2025The Hacker NewsThreat Intelligence / Incident ResponseIn 2024, global ransomware attacks hit 5,414, an 11% increase from 2023. After a slow start, attacks spiked in Q2 and surged in Q4, with 1,827 incidents (33% of the year's total). Law enforcement actions against major groups like LockBit caused fragmentation, leading to more competition and a rise in smaller gangs. The number of active ransomware groups jumped 40%, from 68 in 2023 to 95 in 2024.New Ransomware Groups to WatchIn 2023 there were just 27 new groups. 2024 saw a dramatic rise with 46 new groups detected. As the year went on the number of groups accelerated with Q4 2024 having 48 groups active. Of the 46 new ransomware groups in 2024, RansomHub became dominant, exceeding LockBit's activity. At Cyberint, now a Check Point Company, the research team is constantly researching the latest ransomware groups and analyzing them for potential impact. This blog will look at 3 new players, the aforementioned RansomHub, Fog and Lynx and examine their impact in 2024 and delve into their origins and TTPs.To learn about other new players download the 2024 Ransomware Report here.RansomhubRansomHub has emerged as the leading ransomware group in 2024, claiming 531 attacks on its Data Leak Site since commencing operations in Feb 2024. Following the FBI's disruption of ALPHV, RansomHub is perceived as its 'spiritual successor,' potentially involving former affiliates. Operating as a Ransomware-as-a-Service (RaaS), RansomHub enforces strict affiliate agreements, and RansomHub enforces strict adherence to affiliate agreements, with non-compliance resulting in bans and termination of partnerships. It offers a 90/10 ransom split, Affiliates/Core Group.While claiming a global hacker community, RansomHub avoids targeting CIS nations, Cuba, North Korea, China, and non-profits, exhibiting characteristics of a traditional Russian ransomware setup. Their avoidance of Russian-affiliated nations and overlap with other Russian ransomware groups in targeted companies further highlight their likely connections to Russia's cybercrime ecosystem.Cyberint's August 2024 findings indicate a low payment rate: only 11.2% of victims paid (20 of 190), with negotiations often reducing demands. RansomHub prioritizes attack volume over payment rates, leveraging affiliate expansion to ensure profitability, with the goal of generating substantial revenue over time despite low individual payment success.Malware, Toolset & TTPSRansomHub's ransomware, developed in Golang and C++, targets Windows, Linux, and ESXi, distinguished by its fast encryption. Similarities to GhostSec's ransomware suggest a trend. RansomHub guarantees free decryption if affiliates fail to provide it post-payment or target prohibited organizations. Their ransomware encrypts data before exfiltration. Potential ties to ALPHV are suggested by attack patterns, indicating similar tools and TTPs could be used. Sophos research highlights parallels with Knight Ransomware, including Go-language payloads obfuscated with GoObfuscate and identical command-line menus.Fog RansomwareFog ransomware appeared in early April 2024, targeting U.S. educational networks by exploiting stolen VPN credentials. They use a double-extortion strategy, publishing data on a TOR-based leak site if victims don't pay. In 2024, they attacked 87 organizations globally. An Arctic Wolf report from November 2024 showed Fog initiated at least 30 intrusions, all via compromised SonicWall VPN accounts. Notably, 75% of these intrusions were linked to Akira, with the rest attributed to Fog, suggesting shared infrastructure and collaboration. Fog primarily targets education, business services, travel, and manufacturing, with a focus on the U.S. Interestingly, Fog is one of the few ransomware groups that prioritize the education sector as their primary target.Fog ransomware has demonstrated alarming speed, with the shortest observed time from initial access to encryption being just two hours. Its attacks follow a typical ransomware kill chain, encompassing network enumeration, lateral movement, encryption, and data exfiltration. Versions of the ransomware exist for both Windows and Linux platforms.IOCsTypeValueLast Observation DateIPv4-Addr107.161.50.26Nov 28, 2024SHA-1507b26054319ff31f275ba44ddc9d2b5037bd295Nov 28, 2024SHA-1e1fb7d15408988df39a80b8939972f7843f0e785Nov 28, 2024SHA-183f00af43df650fda2c5b4a04a7b31790a8ad4cfNov 28, 2024SHA-144a76b9546427627a8d88a650c1bed3f1cc0278cNov 28, 2024SHA-1eeafa71946e81d8fe5ebf6be53e83a84dcca50baNov 28, 2024SHA-1763499b37aacd317e7d2f512872f9ed719aacae1Nov 28, 2024SHA-13477a173e2c1005a81d042802ab0f22cc12a4d55Feb 02, 2025SHA-190be89524b72f330e49017a11e7b8a257f975e9aNov 28, 2024Domain-Namegfs302n515.userstorage.mega.co.nzNov 28, 2024SHA-256e67260804526323484f564eebeb6c99ed021b960b899ff788aed85bb7a9d75c3Aug 20, 2024LynxLynx is a double-extortion ransomware group that has been very active lately, displaying many victimized companies on their website. They state that they avoid targeting government organizations, hospitals, non-profit groups, and other essential social sectors. Once they gain access to a system, Lynx encrypts files, appending the ".LYNX" extension. They then place a ransom note named "README.txt" in multiple directories. In 2024 alone, Lynx claimed more than 70 victims, demonstrating their continued activity and significant presence in the ransomware landscape.IOCsTypeValueLast Observation DateMD5e488d51793fec752a64b0834defb9d1dSep 08, 2024Domain-Namelynxback.proSep 08, 2024Domain-Namelynxbllrfr5262yvbgtqoyq76s7mpztcqkv6tjjxgpilpma7nyoeohyd.onionSep 08, 2024Domain-Namelynxblog.netSep 08, 2024IPv4-Addr185.68.93.122Sep 08, 2024IPv4-Addr185.68.93.233Sep 08, 2024MD57e851829ee37bc0cf65a268d1d1baa7aFeb 17, 2025What's to Come in 2025?Due to the crackdown on ransomware groups, the most new groups on record have appeared, seeking to make a name for themselves. In 2025, Cyberint anticipates several of these newer groups to enhance their capabilities and emerge as dominant players, not just RansomHub.Read Cyberint, now a Check Point Company's 2024 Ransomware Report for the top targeted industries and countries, a breakdown of the top 3 ransomware groups, ransomware families worth noting, newcomers to the industry, arrests and news, and 2025 forecasts.Read the 2024 Ransomware Report to Gain Detailed Insights and More.Found this article interesting? This article is a contributed piece from one of our valued partners. Follow us on Twitter and LinkedIn to read more exclusive content we post.SHARE
0 Comments
·0 Shares
·14 Views