Threat video1:00
ReHub Sponsors DragonForce and LockBit: Analysis & Hunting
ReHub is a Russian-language forum sponsoring DragonForce and LockBit. 9 detection rules, 20 IOCs, 20 ATT&CK techniques and a free Splunk SPL rule.
Read the full threat intel for ReHub Sponsors DragonForce and LockBit: Analysis & Hunting →
Chapters
- 0:00The hookReHub Forum Operators threat: 9 detection rules.
- 0:05The storyFollowing the January 28.
- 0:11Attack pathLaunch ReHub marketplace.
- 0:25AttributionAttributed to ReHub Forum Operators.
- 0:31Indicators of compromiseNo malicious indicators were published.
- 0:37MITRE ATT&CK techniques20 ATT&CK techniques, from reconnaissance to impact.
- 0:42Remediation4 steps now: Add ReHub clearweb and .onion domains to threat-intel blocklists.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00ReHub Forum Operators threat: 9 detection rules.
0:05Following the January 28.
0:07On July 22, 2025.
0:12Launch ReHub marketplace.
0:14Deploy clearweb and Tor infrastructure.
0:16Establish ransomware sponsor partnerships.
0:25Attributed to ReHub Forum Operators. Confidence: medium.
0:31No malicious indicators were published.
0:3720 ATT&CK techniques, from reconnaissance to impact.
0:424 steps now: Add ReHub clearweb and .onion domains to threat-intel blocklists.
0:509 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.