Article
Cyclops Blink Botnet Targets ASUS Routers and WatchGuard Devices
Cyclops Blink is a Sandworm-linked botnet that infects Asus and WatchGuard routers. See what its modules do and how to protect your devices.
Read more
Ransomware group profile
RansomHub
Also known as Cyclops, Knight
In short
RansomHub is a ransomware as a service operation, formerly known as Cyclops and Knight, according to a joint advisory (AA24-242A) from the FBI, CISA, MS-ISAC and HHS released on August 29, 2024. The advisory says it had encrypted and stolen data from at least 210 victims since its start in February 2024. Ransomware as a service means the core team rents its malware to partner criminals, called affiliates.
- Other Names2names in public reportsCyclops · Knight
- Entry Routes4ways inPhishing emails · Exploit known flaws · Password spraying
- Techniques7mapped to MITRE ATT&CKValid Accounts · OS Credential Dumping
- Defences6first steps listedRequire strong MFA · Segment the network
Overview
RansomHub is a ransomware as a service operation. The core team supplies the malware and the leak site. Affiliates, who are partner criminals, carry out the intrusions. The FBI, CISA, the Multi-State Information Sharing and Analysis Center (MS-ISAC) and the US Department of Health and Human Services (HHS) described it in advisory AA24-242A, released on August 29, 2024, using FBI response work and third-party reporting up to August 2024.
Where it came from
The advisory says RansomHub was formerly known as Cyclops and Knight and had become an efficient and successful service model. It was attracting high-profile affiliates from other prominent variants, naming LockBit and ALPHV. MITRE ATT&CK describes versions for Windows, ESXi (the software that runs many virtual machines on one host), Linux and FreeBSD, and says the operators may have purchased and rebranded resources from Knight ransomware, which shares infrastructure, features and code with it.
Scale and targets
Since its start in February 2024, RansomHub had encrypted and stolen data from at least 210 victims, per the advisory. These were in water and wastewater, information technology, government services, healthcare, emergency services, food and agriculture, financial services, commercial facilities, critical manufacturing, transportation and communications.
How affiliates get in
Affiliates use phishing emails, known vulnerabilities and password spraying. Password spraying means trying passwords leaked in earlier breaches against many accounts. The advisory says proof-of-concept exploits are taken from public sources such as ExploitDB and GitHub. It lists exploits for flaws in Citrix NetScaler, FortiOS, Apache ActiveMQ, Atlassian Confluence, F5 BIG-IP and FortiClientEMS, plus older Windows flaws.
Inside the network
Affiliates create new accounts for persistence, dump passwords with Mimikatz and move sideways with Remote Desktop, PsExec, AnyDesk and Cobalt Strike. They clear system logs and, in some cases, use special tools to switch off endpoint detection and response (EDR) software. Singapore’s cyber agency says Lynx is one of eight groups using such a tool. The Everest group, described by HHS, also uses Cobalt Strike and AnyDesk. The ransomware itself does not steal data, so how data leaves depends on the affiliate. It uses an elliptic curve method (Curve 25519) to encrypt, and encrypts large files in chunks to work faster.
- February 2024Operation beginsThe advisory dates RansomHub’s inception to February 2024.
- August 2024Latest reporting in advisoryIndicators and tactics identified as recently as August 2024.
- August 29, 2024Joint advisory releasedFBI, CISA, MS-ISAC and HHS publish AA24-242A. At least 210 victims by then.
- August 2024Affiliates from other groupsThe advisory says RansomHub was attracting affiliates from LockBit and ALPHV.
- March 2025MITRE adds software entryMITRE ATT&CK created its RansomHub entry (S1212) on 17 March 2025.
- Model
- Ransomware as a service
- Formerly
- Cyclops and Knight
- Start
- February 2024
- Victims
- At least 210 by August 2024
- Extortion
- Encrypt and steal data, leak site
- Pay deadline in notes
- Three to 90 days, depending on the affiliate
Law enforcement action
The official sources opened for this page are advisories and technical entries. They do not describe an arrest or takedown. Check stopransomware.gov for newer statements.
Also known as
- Cyclops
- Knight
How they get in
-
01
Phishing emails
Affiliates compromise internet-facing systems and user endpoints through phishing emails, among other methods.
-
02
Exploit known flaws
Exploits seen include CVE-2023-3519 (Citrix NetScaler), CVE-2023-27997 (FortiOS), CVE-2023-46604 (Apache ActiveMQ), CVE-2023-22515 (Confluence), CVE-2023-46747 (BIG-IP) and CVE-2023-48788 (FortiClientEMS).
-
03
Password spraying
Affiliates try passwords from earlier data breaches against accounts, then log in with any that work.
-
04
Older Windows flaws
The advisory also lists CVE-2017-0144 (SMBv1) and CVE-2020-1472 (Netlogon) among exploits observed.
How they extort
Double extortion, per the advisory: affiliates encrypt systems and steal data. The ransom note gives a client ID and a unique Tor address (a hidden site reached with the Tor browser) rather than a price. It typically allows between three and 90 days, depending on the affiliate, before data is published on the RansomHub leak site.
Who they target
-
01
Healthcare and public health
See the industry page -
02
Government services and facilities
See the industry page -
03
Financial services
See the industry page -
04
Critical manufacturing
See the industry page -
05
Information technology
See the industry page -
06
Water and wastewater
See the industry page
Tools and malware
- Malware Cobalt Strike Cobalt Strike is a commercial remote access tool sold for adversary simulation, which means security teams use it to test their own networks. Legitimate tool abused · Since 2012 · Linux, macOS, Windows
- Malware Mimikatz Mimikatz is a tool that pulls Windows account logins and passwords out of a computer. Legitimate tool abused · Since 2007 · Windows
Techniques
- Technique Data Encrypted for Impact Data Encrypted for Impact is when attackers encrypt files or whole systems so the owner can no longer use them, and then hold back the key. T1486 · Impact
- Technique Exploit Public-Facing Application Exploit Public-Facing Application is when an attacker abuses a weakness in a system that is reachable from the Internet to get into a network. T1190 · Initial Access
- Technique Indicator Removal Indicator Removal is a technique where an attacker deletes or changes the traces that their activity leaves behind. T1070 · Stealth
- Technique OS Credential Dumping OS credential dumping is when an attacker pulls account login material out of a computer. T1003 · Credential Access
- Technique Phishing (T1566): ATT&CK Technique Phishing is when an attacker sends a message that tricks someone into opening a malicious file, following a link or giving away a password. T1566 · Initial Access
- Technique Remote Services Remote Services is when an attacker uses a valid account to log in to a service built for remote access, such as SSH, RDP or VNC. T1021 · Lateral Movement
- Technique Valid Accounts Valid Accounts means an attacker logs in with real credentials that were stolen or bought. T1078 · Stealth, Persistence, Privilege Escalation, Initial Access
Vulnerabilities they exploit
- Vulnerability Citrix ADC and Gateway code execution (CVE-2023-3519) CVE-2023-3519 is a flaw in NetScaler ADC and NetScaler Gateway, formerly Citrix ADC and Gateway. CVE-2023-3519 · Citrix (Cloud Software Group) · Code injection leading to unauthenticated remote code execution (CWE-94)
- Vulnerability Confluence broken access control (CVE-2023-22515) CVE-2023-22515 is a broken access control flaw in Atlassian Confluence Data Center and Server. CVE-2023-22515 · Atlassian · Broken access control
How to defend
-
Prioritize patching exposed systems
Keep operating systems, software and firmware up to date and patch known exploited vulnerabilities in internet-facing systems first.
-
Require strong MFA
Require phishing-resistant multifactor authentication for administrator accounts and standard MFA for all services where possible.
-
Segment the network
Segment networks to stop ransomware spreading and to limit lateral movement.
-
Review accounts
Review domain controllers, servers, workstations and directories for new or unrecognized accounts, and apply least privilege.
-
Limit command-line use
Disable command-line and scripting activity and permissions where you can. Privilege escalation and lateral movement depend on them.
-
Keep offline backups
Maintain a recovery plan with multiple copies of data in a separate, secure location, and offline backups that are tested regularly.
Questions
What is RansomHub?
RansomHub is a ransomware as a service operation that began in February 2024 and was formerly known as Cyclops and Knight. A joint advisory (AA24-242A) says it had encrypted and stolen data from at least 210 victims by August 2024.
How do RansomHub affiliates get in?
The advisory says affiliates use phishing emails, known vulnerabilities and password spraying. They take proof-of-concept exploits from public sources and target flaws in products such as Citrix NetScaler, FortiOS and Confluence.
How does RansomHub extort victims?
It uses double extortion: affiliates encrypt systems and steal data. The ransom note gives a client ID and a Tor address rather than a price, and allows three to 90 days before data is published on the leak site.
Which sectors did RansomHub hit?
The advisory lists water and wastewater, information technology, government services, healthcare, emergency services, food and agriculture, financial services, critical manufacturing, transportation and communications, among others.
How can I defend against RansomHub?
Patch known exploited flaws in internet-facing systems first, require phishing-resistant MFA for administrators, segment the network to limit lateral movement, and review domain controllers, servers and workstations for new or unrecognized accounts.
In our research
- Cyclops Blink Botnet Targets ASUS Routers and WatchGuard Devices March 2022
- Ransomware examples: attacks, types and groups October 2026
- Top 10 Ransomware Variants Reported to the FBI in 2025 October 2026
- Top 5 Ransomware Groups in Q2 2026: Who They Are, How They Operate, and What They Target July 2026
- Scattered Spider: An Emerging Cybercriminal Collective November 2025
- United Kingdom Cybersecurity Threat Landscape & Strategic Insights October 2025
Sources
- #StopRansomware: RansomHub Ransomware (AA24-242A) CISA, FBI, MS-ISAC, HHS
- RansomHub, Software S1212 MITRE ATT&CK
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.