Security News > 2024 > June > RansomHub extortion gang linked to now-defunct Knight ransomware
Security researchers analyzing the relatively new RansomHub ransomware-as-a-service believe that it has evoloved from the currently defunct Knight ransomware project.
RansomHub has a short history and operated mainly as a data theft and extortion group that sells stolen files to the highest bidder.
In February 2024, the source code for version 3.0 of Knight ransomware put up for sale on hacker forums, the victims extortion portal went offline, and the RaaS operation went silent.
The ransom notes used by the two ransomware families are similar, with minor updates added on RansomHub.
The above suggests that RansomHub was likely derived from Knight, and confirms that the extortion group indeed uses a data encryptor.
According to the researchers, it is unlikely that RansomHub is run by Knight ransomware creators.