RansomHub Ransomware Recovery Guide

RansomHub emerged in February 2024 as a ransomware-as-a-service operation, quickly attracting affiliates with a 90/10 profit split in their favour. It's written in Go and known for speed, using a combination of x25519, AES-256, ChaCha20 and xChaCha20 encryption with AST-based obfuscation.

Unusually broad platform support — Windows, Linux, ESXi, and even ARM and MIPS architectures — means RansomHub is built to hit every layer of a heterogeneous environment in a single incident, not just Windows servers. Its attack chain follows a familiar pattern: phishing or exploit-based entry, RDP/SMB/SSH lateral movement, Mimikatz-based credential theft, then shadow-copy deletion and event log clearing before encryption.

Because it targets Windows, Linux and ESXi in the same incident, recovery after RansomHub typically needs to be assessed across all three simultaneously rather than one system at a time — a mixed environment means mixed recovery approaches: file-system-level for Windows/Linux hosts, datastore/VMDK-level for ESXi, evaluated together so nothing gets missed.