Prolific RansomHub Operation Goes Dark

April 30, 2025 – Published on Dark Reading

RansomHub, an aggressive ransomware-as-a-service (RaaS) operation that gained prominence over the past year in the wake of law enforcement actions against LockBit and ALPHV, appears to have abruptly gone dark earlier this month.

GuidePoint Security noted that a “series of internal disagreements” between RansomHub administrators and some affiliates had caused disruptions within the RaaS operation. The disagreements apparently stirred unease among other RansomHub affiliates, who began diverting their communications with victims to rival platforms.

Shortly after RansomHub’s chat infrastructure and data-leak site went offline on March 31, the rival RaaS group DragonForce announced on the Russian cybercrime forum RAMP that RansomHub was migrating its operations to DragonForce’s new ransomware cartel platform, according to GuidePoint.

“Further muddying the waters, DragonForce goes on to request in their post that RansomHub ‘consider [their] offer,’ leaving it unclear whether the move is actual or proposed, and whether such actions were concomitant or unilateral,” GuidePoint researchers wrote. “We cannot rule out the possibility that the posts represent a form of ‘trolling’ or opportunistic advertising on the part of DragonForce.”

Read More HERE.