# What is RansomHub ransomware?

RansomHub was a ransomware-as-a-service operation that appeared in February 2024 and grew quickly by recruiting affiliates from other platforms, including after the collapse of ALPHV and the LockBit takedown. CISA, the FBI, the MS-ISAC and the US health department described it in joint advisory AA24-242A of 29 August 2024: by then it had encrypted and stolen data from at least 210 victims, in sectors such as water, IT, government services, health care, emergency services, food, financial services and communications. The advisory notes that the operation was formerly known as Cyclops and Knight and uses double extortion. Affiliates typically got in through phishing, password spraying and the exploitation of known vulnerabilities in internet-facing systems. Researchers reported that its infrastructure went offline in April 2025 and that many affiliates moved elsewhere. The pattern is the lesson: brands come and go quickly, while the entry techniques and the recommended defences stay the same.

FAQ: [Ransomware groups and families](https://netsenx.com/en/faq/ransomware-families) · https://netsenx.com/en/faq/what-is-ransomhub-ransomware

## Read next

- https://netsenx.com/en/detect-ransomware-on-the-network
- https://netsenx.com/en/blog/2026-10-24_ransomware-protection

## Related questions

- [What is Cl0p ransomware?](https://netsenx.com/en/faq/what-is-cl0p-ransomware)
- [What is BianLian ransomware?](https://netsenx.com/en/faq/what-is-bianlian-ransomware)
- [What was Hive ransomware?](https://netsenx.com/en/faq/what-was-hive-ransomware)
- [What was Conti ransomware?](https://netsenx.com/en/faq/what-was-conti-ransomware)
- [What are Phobos and 8Base ransomware?](https://netsenx.com/en/faq/what-are-phobos-and-8base-ransomware)