RansomHub

Ransomware written in Golang and obfuscated with Gobfuscate, with significant code overlap to Knight ransomware.

Linked Threat Actors

RansomHub

C2 Infrastructure

Hosting/VPS 94%

ISP/Residential 6%

Last 7 days

May 25, 2026

C2 Hosts: 18

Daily C2 host counts for the last 7 days
Date	C2 Hosts
May 25, 2026	18

Further Reading

SocGholishs Intrusion Techniques Facilitate Distribution of RansomHub Ransomware

Trend Research analyzed SocGholish’s MaaS framework and its role in deploying RansomHub ransomware through compromised websites, using highly obfuscated JavaScript loaders to evade detection and ex...