Close Menu

RANSOMHUB · Threat actor profile

// THREAT ACTOR

RANSOMHUB_

Dormant

RansomHub is a ransomware-as-a-service operation that surfaced in early 2024 and quickly absorbed displaced affiliates from disbanded groups including ALPHV/BlackCat and LockBit. It became one of the most prolific groups by claimed-victim count within months of launching, hitting healthcare, manufacturing, and government targets.

For Ransomnews editorial coverage of RANSOMHUB — incident write-ups, attribution notes, and additional context — see the Threat Groups archive or run a site search.

868 Victims tracked
0 / 46 Active mirrors
2024-02-10 First listing
2025-04-01 Most recent

Victims by year

  • 2025 236
  • 2024 632

Leak site mirrors

46 mirrors tracked, 0 currently reachable. These are criminal-infrastructure URLs — links are deliberately not provided.

  • ransomxifxwc5eteopdobynonjctkxxvap77yqifu2emfbecgbqdw6qd.onion RansomHub | Home snapshot · 2025-04-02 07:00
  • mjmru3yz65o5szsp4rmkmh4adlezcpy5tqjjc4y5z6lozk3nnz2da2ad.onion Index of / snapshot · 2024-05-09 17:21
  • an2ce4pqpf2ipvba2djurxi5pnxxhu3uo7ackul6eafcundqtly7bhid.onion snapshot · 2024-06-17 23:10
  • fpwwt67hm3mkt6hdavkfyqi42oo3vkaggvjj4kxdr2ivsbzyka5yr2qd.onion Index of / snapshot · 2024-08-03 14:00
  • xeuvs5poflczn5i5kbynb5rupmidb5zjuza6gaq22uqsdp3jvkjkciqd.onion snapshot · 2025-03-25 20:14
  • 7vy5mydtkf4hqo3g5s4v7skmyn2xdh4mxg3xgtcqnequuospqtsmutqd.onion snapshot · 2024-12-10 15:53
  • crylcxzmkllsvq3qgh6gmeg3abqcyliepqza2r57o43gsfwomibq2cyd.onion snapshot · 2024-12-10 15:53
  • qa5qvqhtuzlyzrrgc7dkepyj34hb4psf6hk7jmiyn6cef7fxajdleoid.onion snapshot · 2024-12-10 15:53
  • ransombgegc4e2vuq45noxekkmauikzt7qu6ab2rqsthdyxdpdufbqid.onion RansomHub | File Upload snapshot · 2025-04-01 18:00
  • ransomgxjnwmu5ceqwo2jrjssxpoicolmgismfpnslaixg3pgpe5qcad.onion snapshot · 2024-12-10 15:54
  • shedjytnmsdgyey7ho7r52leod3plffhe3yjmhyxfxxivnunnmw7coid.onion snapshot · 2024-12-10 15:54
  • vqcrizmr7757hjbamfcb7pei2zv462o4ypi2djj4xvy5ax7f2b3c7bad.onion snapshot · 2024-12-10 15:54
  • davtdavm734bl4hkr3sr4dvfzpdzuzei2zrcor4vte4a3xuok2rxcmyd.onion snapshot · 2024-12-10 22:33
  • dd4djzr2ywfcox3zfvpkpyh3b657hsdwpwv5cfkmdfde2lr3fpz6spad.onion snapshot · 2024-12-10 22:34
  • cki3klxqycazagx3r5prae3nmfvxmwa34beknr3il4uf76vxd76akqid.onion snapshot · 2024-12-10 22:34
  • pod4gkypkd6kykwoht3kioehhpoh4k75ybdfoe6q7hqbphrd77b32jqd.onion snapshot · 2024-12-10 22:34
  • 445ouvbxlevrxm7phyfr4au3ritat62zl7cwvrarvonrwmququordayd.onion RansomHub - Login snapshot · 2025-02-11 08:32
  • nr4jw2reeta2u4n2sq4sejjudllir4yfotzf5d4p3wn2ep6ddomtxxid.onion snapshot · 2024-12-12 11:45
  • m52fl4estv4lmcvqhssh7mb7nsygiwe7oybhjhny7iuzrzwulq455eqd.onion snapshot · 2024-12-12 11:46
  • brclvwefzszko5xrlan7pebyliqdkv5cw75xksrxp772urjytkko5fyd.onion snapshot · 2024-12-12 12:55
  • rmr2kgq6vzifnyoaz7jaxdx5t6gsxurbakah5bafatsqldtt2mwneyid.onion RansomHub - Login snapshot · 2025-01-09 21:05
  • xdg53hbpwshgtbfbm6m7nv3ckkduo3dfdwdearcsvybfb3qaf4v7suyd.onion RansomHub - Login snapshot · 2024-12-27 16:04
  • toq7bk6abkr6lapwj3k22ffu4ud5jpox7jbfgzetpz7lxb427katstid.onion snapshot · 2024-12-12 16:50
  • tjnt7x2xodhthwrfnabhloogoo66jrgohgzpta22uwbqznsvrm5tu4id.onion RansomHub - Login snapshot · 2025-03-05 17:02
  • fvixrjsdk2adazfnz4mrdvr4eznm346fk33y7nos65bdrtmfvw7f5vid.onion RansomHub - Login snapshot · 2025-03-02 18:12
  • vhxbjx4iaeqgna22kqt5ajlqi72vbm6qcjev3efgr5oiklgptvjvjhqd.onion RansomHub - Login snapshot · 2025-03-17 06:14
  • yszafmehxkoa7hrcay7cnyogfrmjqc4grds6innadspii5oz6fneyzyd.onion RansomHub - Login snapshot · 2025-03-05 20:00
  • i4xita2momkw2jitqohbqgomjxqp53pyvgv5gbogvendbx3ucnynekyd.onion RansomHub - Login snapshot · 2025-03-08 22:05
  • 3ysbtsnhldlijvfdv7hwkr2gl3op2d56puspeo4whs6p272sde6fq5id.onion snapshot · 2025-02-20 17:14
  • bd3atkmicmcif6mliquqdxltjq6mxvagw44gealayp34awtcx3ywlxid.onion 404 Not Found snapshot · 2026-05-09 14:00

Recent victims

The 50 most recent victims claimed by RANSOMHUB. Total in the index: 868.

Date listed Victim Description
2025-04-01 europtec.com
2025-04-01 delta-life.com
2025-04-01 intellioan.com
2025-04-01 jackpotjunction.com
2025-03-29 www.assisi.nl
2025-03-28 phaus.us&phakr.com&phabodysystems.com
2025-03-28 www.bassi.it
2025-03-27 www.allmilmoe.com
2025-03-27 brattenelectrictn.com
2025-03-26 www.hongthongrice.com
2025-03-26 www.fkm-elemente.de
2025-03-26 conterra.com
2025-03-26 www.DSelectrical.com
2025-03-25 www.carolinaac.com
2025-03-25 www.garbinc.com
2025-03-25 www.mododoc.com
2025-03-25 www.argentosc.com
2025-03-25 www.ripplejunction.com
2025-03-25 www.creativelogisticservices.com
2025-03-25 www.afnigc.ca
2025-03-25 www.cormidom.com.do
2025-03-25 www.lions-online.org
2025-03-24 www.solidworld.it
2025-03-24 www.s3s.com
2025-03-24 www.rivaldt.com
2025-03-24 OMLTD.CO.JP
2025-03-24 technicare.com
2025-03-24 cisd.org
2025-03-24 mnm.hu
2025-03-24 texascompressionservices.com
2025-03-24 www.solventacentroamerica.com
2025-03-24 www.exemplar.com
2025-03-21 gbsn.com.br
2025-03-21 www.sinkdirect.com
2025-03-21 www.broadmoormethodist.org
2025-03-21 www.parklandmanufacturing.com
2025-03-21 www.solinst.com
2025-03-21 www.allstarhealthcaresolutions.com
2025-03-21 www.njcalwe.com
2025-03-21 www.gcsnet.com
2025-03-21 www.core-1.com
2025-03-21 www.esquirebrands.com
2025-03-21 www.avalonapparel.com
2025-03-21 www.oneupinnovations.com
2025-03-21 www.scpautomation.com
2025-03-21 www.gestionquintessence.com
2025-03-21 www.engines.man.eu
2025-03-21 www.abmenviro.ca
2025-03-21 www.accessfinanceonline.com
2025-03-21 www.ahmadiyya.ca

← Back to Ransomtracker

Statistics on this page are computed by Ransomnews from a live leak-site monitoring feed. Numbers update every ten minutes. Operator-written victim descriptions are truncated and shown in snippet form only. Source data: RansomLook (CC BY 4.0), aggregated and adapted by Ransomnews.