RansomHub is a ransomware-as-a-service (RaaS) platform that first appeared in February 2024. It quickly became one of the most prolific ransomware groups, filling the void left by LockBit’s law enforcement setbacks and BlackCat/ALPHV’s dissolution. RansomHub attracted experienced affiliates—many formerly with LockBit and BlackCat—by offering a more affiliate-friendly payment model, where affiliates control ransom payments and remit only a 10% commission to the core group, reducing the risk of “exit scams” that plagued previous syndicates.