EudorIACyber Intelligence
Operational monitoring Newsletter IT EN
← Back to intelligence
Ransomware

#StopRansomware: RansomHub Ransomware

Official source
EudorIA operational summary

What it means

Priority 95/100

CISA Cybersecurity Advisories ha pubblicato un advisory sul ransomware RansomHub. La fonte descrive vulnerabilita o tecniche gia osservate in attacchi e richiede una verifica prioritaria.

Why it matters

L'advisory descrive attivita ransomware osservate e misure difensive pubblicate da un'autorita. Non prova che il proprio perimetro sia compromesso, ma richiede una verifica prioritaria di esposizione e controlli.

Recommended actions

  1. Verificare e correggere con priorita i sistemi Internet-facing indicati dalla fonte; applicare MFA resistente al phishing, segmentazione e backup offline immutabili con prove di ripristino.
  2. Verificare sistemi esposti, accessi remoti e versioni rispetto all'advisory ufficiale.
  3. Confermare che backup offline e immutabili siano separati e ripristinabili.
  4. Correlare TTP e IOC pubblicati con la telemetria autorizzata del proprio perimetro.

Potential operational benefits

  • Prioritizzazione delle esposizioni Internet e delle vulnerabilita sfruttate
  • Verifica dei controlli su accessi remoti, movimento laterale ed esfiltrazione
  • Validazione documentata della capacita di ripristino
Indications to confirm against the customer's technical and organisational perimeter.
Relevant controlsVulnerability managementIdentity and access managementNetwork segmentationBackup and recoveryDetection and response
AudienceITSOCCISOManagement
Information centre

Translation in progress

CISA

The official content is available in the original language. The Italian version will be published once automated checks are complete.

Text acquired from the source

Cybersecurity Advisory #StopRansomware: RansomHub Ransomware Release Date August 29, 2024 Alert Code AA24-242A Related topics: Cyber Threats and Response , Incident Response , Malware, Phishing, and Ransomware Actions to take today to mitigate cyber threats from ransomware: Install updates for operating systems, software, and firmware as soon as they are released. Require phishing-resistant MFA (i.e., non-SMS text based) for as many services as possible. Train users to recognize and report phishing attempts. Summary Note: This joint Cybersecurity Advisory is part of an ongoing #StopRansomware effort to publish advisories for network defenders that detail various ransomware variants and ransomware threat actors. These #StopRansomware advisories include recently and historically observed tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) to help organizations protect against ransomware. Visit stopransomware.gov to see all #StopRansomware advisories and to learn more about other ransomware threats and no-cost resources. The Federal Bureau of Investigation (FBI), the Cybersecurity and Infrastructure Security Agency (CISA), the Multi-State Information Sharing and Analysis Center (MS-ISAC), and the Department of Health and Human Services (HHS) (hereafter referred to as the authoring organizations) are releasing this joint advisory to disseminate known RansomHub ransomware IOCs and TTPs. These have been identified through FBI threat response activities and third-party reporting as recently as August 2024. RansomHub is a ransomware-as-a-service variant—formerly known as Cyclops and Knight—that has established itself as an efficient and successful service model (recently attracting high-profile affiliates from other prominent variants such as LockBit

Indicatori CISA verificabili

121 valori IOC dalla fonte ufficiale. Non sono una lista di blocco automatica: verificare data, contesto e applicabilita.

Copertura parziale: sono mostrati solo gli indicatori verificati e interpretabili. 1 allegati richiedono ancora verifica o un formato supportato.

Ultima verifica: 2026-09-26T06:31:10.950637+00:00

Scarica STIX 2.1
TipoIndicatore (non cliccabile)File
urlhttps://samuelelena[.]co/npm/module[.]tripadvisor/module[.]tripadvisor
urlhttp://89[.]23[.]96[.]203/333/en/d%E5%AD%97%E5%AD%97[.]resources/d%E5%AD%97%E5%AD%97[.]resources[.]exe
urlhttp://89[.]23[.]96[.]203/333/en/d%E5%AD%97%E5%AD%97[.]resources/d%E5%AD%97%E5%AD%97[.]resources[.]dll
urlhttp://89[.]23[.]96[.]203/333/en/d%E5%AD%97%E5%AD%97[.]resources[.]exe
urlhttp://89[.]23[.]96[.]203/333/en/d%E5%AD%97%E5%AD%97[.]resources[.]dll
urlhttp://89[.]23[.]96[.]203/333/en-US/d%E5%AD%97%E5%AD%97[.]resources/d%E5%AD%97%E5%AD%97[.]resources[.]exe
urlhttp://89[.]23[.]96[.]203/333/en-US/d%E5%AD%97%E5%AD%97[.]resources/d%E5%AD%97%E5%AD%97[.]resources[.]dll
urlhttp://89[.]23[.]96[.]203/333/en-US/d%E5%AD%97%E5%AD%97[.]resources[.]exe
urlhttp://188[.]34[.]188[.]7/555/NEWOFFICIALPROGRAMCAUSEOFNEWUPDATE[.]INI
urlhttps://40031[.]co/npm/module[.]tripadvisor/module[.]tripadvisor[.]js
urlhttps://40031[.]co/npm/module[.]external/client[.]min[.]js
urlhttps://40031[.]co/npm/module[.]external/moment[.]min[.]js
urlhttps://40031[.]co/npm/module[.]external/jquery[.]min[.]js
urlhttps://40031[.]co/npm/module[.]tripadvisor/module[.]tripadvisor[.]css
urlhttp://samuelelena[.]co/npm/module[.]external/jquery[.]min[.]js
urlhttp://samuelelena[.]co:443/
urlhttps://samuelelena[.]co/np
urlhttps://samuelelena[.]co/npm/module[.]external
urlhttp://samuelelena[.]co/npm/module[.]external/client[.]min[.]js
urlhttp://samuelelena[.]co/npm/module[.]tripadvisor/module[.]tripadvisor[.]js
urlhttp://samuelelena[.]co/npm/
urlhttps://samuelelena[.]co/npm
urlhttp://samuelelena[.]co/
urlhttps://samuelelena[.]co/
urlhttps://samuelelena[.]co/npm/module[.]external/client[.]min[.]js
urlhttps://samuelelena[.]co/npm/module[.]external/moment[.]min[.]js
urlhttps://12301230[.]co/npm/module[.]tripadvisor/module[.]tripadvisor[.]js
urlhttps://12301230[.]co/npm/module[.]external/client[.]min[.]js
urlhttps://12301230[.]co/npm/module[.]external/moment[.]min[.]js
urlhttps://12301230[.]co/npm/module[.]external/jquery[.]min[.]js
urlhttps://12301230[.]co/npm/module[.]tripadvisor/module[.]tripadvisor[.]css
urlhttps://i[.]ibb[.]com:443/V3Kj1c2/1154761258[.]png
urlhttps://i[.]ibb[.]co/X2FR8Kz/2113791011[.]png
urlhttps://i[.]ibb[.]co/V3Kj1c2/1154761258[.]png
urlhttps://i[.]ibb[.]co/v1bn9ZK/369210627[.]png
urlhttps://i[.]ibb[.]co/SxQLwYm/1038436121[.]png
urlhttps://i[.]ibb[.]co/p1RCtpy/2681232755[.]png
urlhttps://i[.]ibb[.]co/nbMNnW4/2501108160[.]png
urlhttps://i[.]ibb[.]co/HK0jV1G/534475006[.]png
urlhttps://i[.]ibb[.]co/Fxhyq6t/2077411869[.]png
urlhttps://i[.]ibb[.]co/b1bZBpg/2615174623[.]png
urlhttps://i[.]ibb[.]co/4g6jH2J/2773036704[.]png
urlhttps://i[.]ibb[.]co/2KBydfw/112882618[.]png
urlhttps://grabify[.]link/Y33YXP
urlhttp://temp[.]sh/KnCqD/superloop[.]exe
urlhttp://89[.]23[.]96[.]203/333/xwenxub285p83ecrzvft[.]exe[.]Config
urlhttp://89[.]23[.]96[.]203/333/winnlsres[.]dll
urlhttp://89[.]23[.]96[.]203/333/WINMMBASE[.]dll
urlhttp://89[.]23[.]96[.]203/333/WINMM[.]dll
urlhttp://89[.]23[.]96[.]203/333/WININET[.]dll
urlhttp://89[.]23[.]96[.]203/333/winhttp[.]dll
urlhttp://89[.]23[.]96[.]203/333/webio[.]dll
urlhttp://89[.]23[.]96[.]203/333/USERENV[.]dll
urlhttp://89[.]23[.]96[.]203/333/urlmon[.]dll
urlhttp://89[.]23[.]96[.]203/333/xwenxub285p83ecrzvft[.]exe
urlhttp://89[.]23[.]96[.]203/333/TmsLA6kdcU8jxKzpMvbUVweTeF5YcR[.]exe[.]Config
urlhttp://89[.]23[.]96[.]203/333/SspiCli[.]dll
urlhttp://89[.]23[.]96[.]203/333/msi[.]dll
urlhttp://89[.]23[.]96[.]203/333/mshtml[.]dll
urlhttp://89[.]23[.]96[.]203/333/IPHLPAPI[.]DLL
urlhttp://89[.]23[.]96[.]203/333/information[.]INI
urlhttp://89[.]23[.]96[.]203/333/information[.]exe[.]Config
urlhttp://89[.]23[.]96[.]203/333/information[.]exe
urlhttp://89[.]23[.]96[.]203/333/iertutil[.]dll
urlhttp://89[.]23[.]96[.]203/333/en-US/d%E5%AD%97%E5%AD%97[.]resources[.]dll
urlhttp://89[.]23[.]96[.]203/333/en-US
urlhttp://89[.]23[.]96[.]203/333/en
urlhttp://89[.]23[.]96[.]203/333/DPAPI[.]DLL
urlhttp://89[.]23[.]96[.]203/333/cv4TCGxUjvS[.]exe
urlhttp://89[.]23[.]96[.]203/333/CRYPTSP[.]dll
urlhttp://89[.]23[.]96[.]203/333/cryptnet[.]dll
urlhttp://89[.]23[.]96[.]203/333/CRYPTBASE[.]DLL
urlhttp://89[.]23[.]96[.]203/333/Cabinet[.]dll
urlhttp://89[.]23[.]96[.]203/333/bcrypt[.]dll
urlhttp://89[.]23[.]96[.]203/333/ambapdf[.]ico[.]DLL
urlhttp://89[.]23[.]96[.]203/333/AmbaPDF[.]ico
urlhttp://89[.]23[.]96[.]203/333/92[.]exe
urlhttp://89[.]23[.]96[.]203/333/9[.]exe
urlhttp://89[.]23[.]96[.]203/333/8[.]exe
urlhttp://89[.]23[.]96[.]203/333/7[.]exe
urlhttp://89[.]23[.]96[.]203/333/6[.]exe
urlhttp://89[.]23[.]96[.]203/333/5[.]exe[.]Config
urlhttp://89[.]23[.]96[.]203/333/4[.]exe[.]Config
urlhttp://89[.]23[.]96[.]203/333/3[.]exe[.]Config
urlhttp://89[.]23[.]96[.]203/333/2wrRR6sW6XJtsXyPzuhWhDG7qwN4es[.]exe[.]Config
urlhttp://89[.]23[.]96[.]203/333/2[.]exe[.]Config
urlhttp://89[.]23[.]96[.]203/333/2[.]exe
urlhttp://89[.]23[.]96[.]203/333/12[.]exe[.]Config
urlhttp://89[.]23[.]96[.]203/333/12[.]exe
urlhttp://89[.]23[.]96[.]203/333/10[.]exe
urlhttp://89[.]23[.]96[.]203/333/1[.]exe[.]Config
urlhttp://89[.]23[.]96[.]203/333/1[.]exe
urlhttp://89[.]23[.]96[.]203/333/
urlhttp://89[.]23[.]96[.]203/333
urlhttp://89[.]23[.]96[.]203/
urlhttp://188[.]34[.]188[.]7/555/NEWOFFICIALPROGRAMCAUSEOFNEWUPDATE[.]exe[.]Config
urlhttp://188[.]34[.]188[.]7/555/NEWOFFICIALPROGRAMCAUSEOFNEWUPDATE[.]exe
urlhttp://188[.]34[.]188[.]7/555/en-US
urlhttp://188[.]34[.]188[.]7/555/en
urlhttp://188[.]34[.]188[.]7/555/CRYPTSP[.]dll
urlhttp://188[.]34[.]188[.]7/555/bcrypt[.]dll
urlhttp://188[.]34[.]188[.]7/555/amba16[.]ico
urlhttp://188[.]34[.]188[.]7/555/
urlhttp://188[.]34[.]188[.]7/555
ipv4-addr193[.]233[.]254[.]21
ipv4-addr193[.]124[.]125[.]78
ipv4-addr193[.]106[.]175[.]107
ipv4-addr45[.]134[.]140[.]69
ipv4-addr45[.]95[.]67[.]41
ipv4-addr8[.]211[.]2[.]97
urlhttps://samuelelena[.]co/npm/module[.]tripadvisor/module[.]tripadvisor[.]js
ipv4-addr188[.]34[.]188[.]7
email-addrbrahma2023[@]onionmail[.]org
urlhttp://89[.]23[.]96[.]203/333/5[.]exe
urlhttp://89[.]23[.]96[.]203/333/TmsLA6kdcU8jxKzpMvbUVweTeF5YcR[.]exe
urlhttp://89[.]23[.]96[.]203/333/3[.]exe
urlhttp://89[.]23[.]96[.]203/333/4[.]exe
ipv4-addr89[.]23[.]96[.]203
urlhttp://89[.]23[.]96[.]203/333/2wrRR6sW6XJtsXyPzuhWhDG7qwN4es[.]exe
domain-namesamuelelena[.]co
ipv4-addr45[.]135[.]232[.]2

Provenance

Allegato ufficiale CISA · 2024-08-28T15:33:18Z

SHA-512: 08c17b6d29010a16e22e24e0cc26dc5a885e5fecfc265f5928eb8a531c71ddb7153e799d677cf32e931434ec1fd538ea602a614e1b5f1029bfaf1daa5bbf8963

Source
CISA Cybersecurity Advisories
Publishing entity
CISA
Entity type
National authority
Area
North America · US
Original language
en · translation in preparation
Publication
29/08/2024 14:00
Sharing
TLP:CLEAR
MITRE ATT&CK
T1003, T1018, T1021.001, T1027, T1036, T1046, T1047, T1048.002, T1048.003, T1059, T1059.001, T1068, T1070, T1098, T1110.003, T1136, T1190, T1210, T1219, T1486, T1490, T1537, T1562.001, T1566, T1588.005
CVE
CVE-2023-3519, CVE-2023-27997, CVE-2023-46604, CVE-2023-22515, CVE-2023-46747, CVE-2023-48788, CVE-2017-0144, CVE-2020-1472, CVE-2020-0787
Classification
Critical
Group attributed by the source
RansomHub
Stated country
US
Technical scope

Affected products and versions

Verification in progress
Information not yet acquired.

The collector will check NVD and the available official vendor advisories.

Action indicated by the source

Verificare e correggere con priorita i sistemi Internet-facing indicati dalla fonte; applicare MFA resistente al phishing, segmentazione e backup offline immutabili con prove di ripristino.

Official technical references

Open the original source