Rise of the New Version of Knight Ransomware in Hospitals

The world is alarmed by a series of ransomware attacks carried out by Ransomhub. In April alone, there were 26 reports of attacks on hospitals and other organizations such as Christie’s auction house. London hospitals had to halt blood transfusions and surgeries due to these attacks.

What is Ransomhub? It is an updated version of the ransomware program Knight. In early 2024, the source code of Knight was put up for sale on the dark web. The new owner (or possibly the same owner) has improved the program and now offers it as Ransomware-as-a-Service (RaaS). This service actively attracts affiliates. Many former users of Lockbit are switching to Ransomhub because Lockbit’s operation has recently been heavily impacted by law enforcement. The person behind Lockbit remains at large and active.

Healthcare Sector Under Fire

In the past, various RaaS operations stated that attacks on the healthcare sector were unacceptable, especially during the pandemic. However, recently, Ransomhub has been targeting healthcare institutions and their suppliers.

Double Extortion: In addition to the traditional ransomware business model, where ransom is demanded to restore access to encrypted data, criminals are now also using the “double extortion” method. They first steal data and then threaten to sell or release it publicly.

Faster Than Before: The rapid growth and development of this new RaaS service suggest that Ransomhub will play a significant role in the cybercriminal world. This is concerning because the time between initial access and the deployment of ransomware is becoming increasingly shorter.

Research from shows that since 2023, ransomware has been deployed in more than half of cases within a week. In a third of cases, it happens within 48 hours. The majority of ransomware is activated outside of working hours, often early in the morning.

Methods Used

As is common in ransomware attacks, initial access often occurs through credentials obtained via phishing or spearphishing. Therefore, it is essential that your organization continuously focuses on the cybersecurity awareness of your employees, for example, through the SAFE program.

The hackers install malware and increasingly also remote access software. Think of programs like TeamViewer, VNC, Atera, and Splashtop. They also frequently exploit known vulnerabilities in the internal network.

What Known Vulnerabilities?

We can never know exactly what the ransomware affiliates are trying. But based on our research, we can indicate what regularly goes wrong in cybersecurity in healthcare. Attackers themselves sometimes provide advice, as seen in the image below.