RansomHub Ransomware Group Lists Two New Victims on Dark Web Portal

The RansomHub ransomware group, a prolific Ransomware-as-a-Service (RaaS) operation, has intensified its double-extortion tactics by adding two new U.S. victims to its dark web leak portal: Keystone Pacific Property Management LLC, a California-based real estate firm, and Environmental Laboratories, Inc., an environmental testing company.

The group threatens to publish stolen data within 6–7 days unless ransom demands are met, marking another escalation in its global cybercrime spree.

RansomHub’s Evolution and Tactics

According to the post from FalconFeeds.io, Emerging in early 2024 from the remnants of the ALPHV/BlackCat and LockBit ransomware networks, RansomHub has rapidly ascended as a dominant threat actor.

Operating under a RaaS model, the group provides affiliates with advanced encryption tools and infrastructure in exchange for a share of profits, leveraging a prepayment system to ensure financial viability.

Its attacks employ double extortion, combining data encryption with exfiltration of sensitive information to pressure victims into payment.

Technical analyses reveal RansomHub’s exploitation of critical vulnerabilities, including CVE-2021-42278 (noPac) and CVE-2020-1472 (ZeroLogon), to escalate privileges and compromise Microsoft Active Directory domains.

Affiliates often deploy tools like Mimikatz for credential dumping and PsExec for lateral movement, while ransomware payloads target Windows, Linux, and ESXi systems.

The group’s dark web portal, used to publicly shame victims, has listed over 600 entities since February 2024, spanning healthcare, critical infrastructure, and now property management.

Keystone Pacific Property Management Breach

Keystone Pacific, managing over 200 community associations across California, Colorado, and Idaho, first detected a breach on December 17, 2023, when unusual activity disrupted its systems.

Forensic investigations confirmed unauthorized access to sensitive data, including Social Security numbers, driver’s licenses, medical records, and financial information—a trove aligning with RansomHub’s targeting of high-value data.

By August 2024, Keystone notified impacted individuals and offered 24 months of credit monitoring, though specifics on the ransomware variant were initially undisclosed.

RansomHub’s inclusion of Keystone on its leak site suggests the group either orchestrated the initial breach or acquired the data from earlier attackers.

The threat of publication amplifies regulatory risks for Keystone, including potential penalties under California’s Consumer Privacy Act (CCPA) and federal HIPAA guidelines if medical data is exposed.

Legal firms like Strauss Borrelli PLLC have already initiated investigations into the incident, highlighting the liability facing property management sectors.

Environmental Laboratories, Inc. at Risk

While details on Environmental Laboratories, Inc.’s breach remain sparse, the company’s role in environmental testing implies access to sensitive ecological or industrial data.

RansomHub’s history of targeting critical infrastructure—such as energy and healthcare—suggests the lab’s operational or client data could be leveraged for extortion.

The group’s 6–7 day ultimatum leaves limited time for incident response, a common tactic to force rushed payments.

Implications and Mitigation Strategies

RansomHub’s latest strikes underscore the vulnerability of sectors handling sensitive client data.

The group’s recruitment of LockBit and ALPHV affiliates has bolstered its technical prowess, enabling rapid network compromise—often within 24 hours of initial access.

Cybersecurity experts urge organizations to prioritize:

• Patch management: Immediate remediation of vulnerabilities like ZeroLogon and noPac.
• Endpoint Detection and Response (EDR): Real-time monitoring to disrupt lateral movement.
• Multi-factor authentication (MFA): Mitigating credential theft via phishing or brute-force attacks.
• Data backups: Ensuring immutable copies to restore systems without ransom payments.

As RansomHub continues refining its TTPs, the dual threat of operational disruption and reputational damage remains acute.

With the group’s dark web countdown ticking, the coming days will test the resilience of Keystone and Environmental Laboratories—and the broader fight against cyber extortion.

Also Read:

Funksec Ransomware Group Lists MOON Tech Ltd and STAYZAPP on Dark Web

See more