Threat video1:00
Rehub Ransomware Marketplace After RAMP: Detection & IOCs
Rehub, a Russian forum with over 8,300 users, is now a primary ransomware marketplace. Its 9 detection rules, 17 IOCs and a free Splunk SPL rule cover it.
Read the full threat intel for Rehub Ransomware Marketplace After RAMP: Detection & IOCs →
Chapters
- 0:00The hookRehub becomes ransomware hub: about 8,300 users.
- 0:05The storyXSS was seized.
- 0:11Attack pathRehub lists stolen access and RaaS affiliate programs.
- 0:27AttributionAttributed to ReHub Forum Operators.
- 0:32Indicators of compromise2 indicators to hunt: 2 domains.
- 0:38MITRE ATT&CK techniques7 ATT&CK techniques, from resource development to impact.
- 0:42Remediation3 steps now: Add Rehub/RehubCom, DamageLib and the named RaaS brands to dark-web.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Rehub becomes ransomware hub: about 8,300 users.
0:06XSS was seized. Rehub rose.
0:08RAMP fell. Rehub absorbed users.
0:12Rehub lists stolen access and RaaS affiliate programs.
0:16White-label encryptors and malware tools on the marketplace.
0:19Attackers exploit BYOVD to bypass defenses and encrypt.
0:23They extort.
0:27Attributed to ReHub Forum Operators. Confidence: low.
0:322 indicators to hunt: 2 domains.
0:387 ATT&CK techniques, from resource development to impact.
0:433 steps now: Add Rehub/RehubCom, DamageLib and the named RaaS brands to dark-web.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.