If your team tracks work in Atlassian Confluence, pay attention. RansomHub, a ransomware-as-a-service operation that emerged earlier this year, has already claimed at least 210 victims—and security agencies just flagged the tools project managers rely on as part of the problem.
A joint advisory from the FBI, CISA, the Department of Health and Human Services, and the Center for Multinational Information Sharing and Analysis describes how RansomHub breaks in. The techniques aren't exotic. They exploit systems your organization probably has sitting on the internet right now.
How RansomHub Breaks In
The advisory outlines a familiar pattern dressed in new clothes. Attackers start with phishing emails and password spraying—guessing common credentials until something sticks. They also hunt for known vulnerabilities in internet-facing systems. Specifically, the advisory flags Citrix NetScaler, Fortigate, and Atlassian Confluence as platforms RansomHub partners actively exploit.
Once inside, the playbook gets more sophisticated. Partners use network scanning tools to map the environment, then deploy ransomware renamed to look harmless. They delete logs to cover their tracks and disable antivirus and endpoint detection software. To move laterally, they use tools like RDP, PsExec, and Cobalt Strike—some of which legitimate IT departments use for remote support daily.
For data theft, the group reaches for PuTTY, WinSCP, and Amazon AWS S3 tools. They use HTTP POST requests and utilities like Rclone to pull files out of the network. The ransomware skips executable files during encryption, which helps it avoid some detection mechanisms that flag suspicious file access patterns.
The ransom note—titled "How To Restore Your Files.txt"—gives victims a client ID and a .onion URL to contact. The deadline? Between three and 90 days depending on which affiliate handled the attack. Miss that window, and your data appears on RansomHub's public leak site.
Why This Matters for Your Team
Here's the uncomfortable question: when was the last time someone patched that Atlassian Confluence instance your organization runs? Or the Citrix ADC sitting at the edge of your network?
These platforms are staples in IT environments. Confluence hosts project documentation, meeting notes, and sprint records. Many Agile teams treat it as a shared brain for the organization. If an attacker compromises that system, they're not just grabbing files—they're grabbing institutional knowledge, product specifications, and whatever else lives in those pages.
RansomHub's growth strategy explains why this threat escalated so quickly. The group recruited affiliates who previously worked for LockBit and ALPHV/BlackCat—operations disrupted by law enforcement but never fully eliminated. When those groups faltered, skilled operators went shopping for a new platform. RansomHub offered attractive terms: affiliates keep the ransom payments and only remit a service fee afterward. There's no exclusivity requirement, so the same partners can run multiple operations simultaneously.
This means the adversary got better without starting from scratch. The techniques aren't new, but experienced operators are executing them.
Who Should Care About This
| Role | Primary Concern | Immediate Action |
|---|---|---|
| IT Security Teams | Unpatched internet-facing systems are entry points | Patch Confluence, NetScaler, and Fortigate immediately; verify MFA on admin interfaces |
| Project Managers | Confluence hosts sprint docs, retrospectives, and institutional memory | Verify backups exist outside ransomware reach; confirm access controls are enforced |
| DevOps/Platform Teams | Lateral movement tools (PsExec, Cobalt Strike) blend with legitimate admin activity | Audit scheduled maintenance windows; flag activity outside normal patterns |
| Leadership | RansomHub recruits experienced affiliates; the threat is sophisticated | Ensure patching isn't deprioritized for "stable" systems; this is exactly what attackers target |
Our Analysis
RansomHub's emergence illustrates a troubling dynamic in the ransomware market. When law enforcement disrupts a major operation, it doesn't eliminate the threat—it displaces it. Skilled affiliates migrate to new platforms, often with improved infrastructure and refined tactics learned from previous failures. The result is a continuously evolving ecosystem that gets better at what it does.
What makes this particularly dangerous is the RaaS model's efficiency. The group handles malware development, infrastructure, and negotiations. Affiliates provide initial access and local knowledge about targets. This division of labor means even moderately skilled attackers can run sophisticated campaigns. The lack of exclusivity requirements accelerates this effect—partners can bring their experience from multiple operations without restriction.
For organizations using the platforms RansomHub targets, the takeaway isn't panic—it's prioritization. Patching internet-facing systems like Confluence, Citrix NetScaler, and Fortigate devices should move up the queue. Multi-factor authentication on administrative interfaces matters. Logging and monitoring for the tools RansomHub uses for lateral movement can catch intrusions earlier.
What to Watch Next
RansomHub will likely continue recruiting affiliates as other groups face pressure. Watch for increased targeting of collaboration and project management platforms, since those systems often contain valuable intellectual property and receive less security attention than traditional server infrastructure.
Check whether your organization has automated patching for Confluence and similar tools. If not, flag it. The difference between a patched system and one running last year's version is exactly the window these attackers need.
Bottom Line
RansomHub poses a real threat to organizations using common project management and collaboration tools. The attack methods aren't new, but the group combining them has attracted experienced operators from disrupted ransomware gangs. Basic security hygiene—patching, multi-factor authentication, monitoring for unusual remote access—directly addresses the most common entry points. This isn't fearmongering. It's the kind of practical awareness that helps teams protect what they've built.
Key takeaways
- RansomHub exploits unpatched internet-facing systems, including Atlassian Confluence—prioritize patching these platforms
- Multi-factor authentication on collaboration tools prevents the password spraying attacks this group uses for initial access
- Monitor for legitimate remote access tools (PsExec, Cobalt Strike, AnyDesk) running outside expected maintenance windows
- Collaboration platforms often contain institutional knowledge—assume your Confluence instance is a high-value target
- The RaaS model's division of labor means even less-skilled attackers can execute sophisticated campaigns; defense in depth matters more than hoping the threat stays away
Frequently asked questions
What is RansomHub and how did it grow so fast?
RansomHub is a ransomware-as-a-service group that emerged earlier this year. It grew rapidly by recruiting experienced affiliates from disrupted operations like LockBit and ALPHV/BlackCat, offering favorable terms where partners keep most ransom payments.
Which systems does RansomHub target?
The group exploits internet-facing systems including Atlassian Confluence, Citrix NetScaler, and Fortigate devices. It also uses phishing emails and password spraying to gain initial access before moving laterally through networks.
How does RansomHub encrypt files?
The ransomware appends random file extensions to encrypted files and drops a ransom note titled "How To Restore Your Files.txt." It typically skips executable files during encryption, which helps it evade some security tools.
What should organizations using Confluence do right now?
Verify that Confluence is fully patched, enforce multi-factor authentication on all accounts, and ensure backups exist in a location the ransomware cannot reach. Check that administrative access is restricted and monitored.
How long do victims have to pay the ransom?
RansomHub gives victims between three and 90 days to pay, depending on which affiliate conducted the attack. If the deadline passes, the group publishes stolen data on its Tor-based leak site. **END**