S1212 · threatengine.sh

Home/Tool / Malware/RansomHub

Tool / Malware

RansomHub

S1212 · Linux, Windows

RansomHub is a ransomware-as-a-service (RaaS) offering with Windows, ESXi, Linux, and FreeBSD versions that has been in use since at least 2024 to target organizations in multiple sectors globally. RansomHub operators may have purchased and rebranded resources from Knight (formerly Cyclops) Ransomware which shares infrastructure, feature, and code overlaps with RansomHub.

ATT&CK S1212 48 indicators

Sigma rules0 YARA rules0 Live IOCs48

⚊

Live Indicators

48 total

Indicators are defanged for safe handling. Newest first.

Show indicators (48)ip:port195[.]123[.]240[.]236:443
ip:port195[.]123[.]240[.]236:8274
ip:port45[.]66[.]248[.]82:443
ip:port45[.]66[.]248[.]82:53802
ip:port195[.]88[.]191[.]41:443
ip:port195[.]88[.]191[.]41:7666
ip:port185[.]180[.]198[.]3:2025
ip:port185[.]180[.]198[.]3:443
ip:port104[.]238[.]60[.]108:443
ip:port104[.]238[.]60[.]108:54372
ip:port185[.]72[.]8[.]137:443
ip:port185[.]72[.]8[.]137:7882
ip:port185[.]233[.]166[.]124:443
ip:port185[.]233[.]166[.]124:9702
ip:port173[.]44[.]141[.]226:443
ip:port193[.]203[.]49[.]90:443
ip:port38[.]146[.]28[.]93:443
ip:port185[.]33[.]86[.]15:443
ip:port38[.]146[.]28[.]93:8000
ip:port193[.]203[.]49[.]90:8000
ip:port185[.]33[.]86[.]15:8000
ip:port173[.]44[.]141[.]226:8000
ip:port92[.]118[.]112[.]208:8000
ip:port92[.]118[.]112[.]208:443
ip:port88[.]119[.]175[.]65:443
ip:port88[.]119[.]175[.]65:8000
ip:port38[.]180[.]81[.]153:443
ip:port38[.]180[.]81[.]153:8000
ip:port185[.]174[.]101[.]240:443
ip:port185[.]174[.]101[.]240:8000
ip:port185[.]174[.]101[.]69:443
ip:port185[.]174[.]101[.]69:8000
ip:port108[.]181[.]115[.]171:443
ip:port108[.]181[.]115[.]171:8000
ip:port162[.]248[.]224[.]236:7492
ip:port162[.]248[.]225[.]165:443
ip:port162[.]248[.]225[.]165:8603
ip:port162[.]248[.]224[.]236:443
ip:port193[.]5[.]65[.]169:4348
ip:port193[.]5[.]65[.]169:443
ip:port45[.]56[.]162[.]61:443
ip:port45[.]56[.]162[.]61:6031
ip:port185[.]72[.]8[.]121:443
ip:port185[.]72[.]8[.]121:1032
ip:port162[.]252[.]173[.]12:443
ip:port162[.]252[.]173[.]12:8000
ip:port108[.]181[.]182[.]143:443
ip:port108[.]181[.]182[.]143:8000

Aliases

RansomHub

Intelligence Graph · click any node to traverse

CVETechnique ActorTool Family

drag to reposition · click any node to traverse · button top-right enlarges

External lookups - second-class, for what we don’t hold ourselves

MITRE ATT&CK Malpedia MalwareBazaar ThreatFox

Vulnerabilities
CISA KEV catalog
CWE weaknesses
CAPEC attack patterns
Package vulnerabilities

Threat intelligence
Threat actors
Tools & malware
ATT&CK techniques
IOCs

Detection & defense
Sigma rules
YARA rules
Atomic Red Team tests
D3FEND countermeasures

Compliance
NIST 800-53
ISO 27001:2022
SOC 2 TSC
PCI-DSS v4.0
CIS Controls v8.1

About
All capabilities
Live statistics
Data sources
Privacy policy
Terms of service

threatengine.sh · Open-source threat intelligence platform · 100+ authoritative sources · Every fact traces to its origin