RansomHub
Ransomware-as-a-service operation, formerly Cyclops and Knight, whose leak site went dark in April 2025.
RansomHub's leak site went offline on 1 April 2025 and posted no new victims after that date, according to ZeroFox. A DragonForce account claimed the operation was moving onto DragonForce infrastructure; ZeroFox found no evidence of the move.
Last refreshed: 12 October 2026
Where did RansomHub's affiliates go when its leak site vanished?
Timeline for RansomHub
Mentioned in: Ransomware crews' claims fall to 815
Cybersecurity: Threats and DefencesBackground
RansomHub ran as a ransomware-as-a-service brand, known first as Cyclops and then as Knight, renting its tools to affiliates. Joint advisory AA24-242A from the FBI, CISA, MS-ISAC and HHS counted at least 210 victims whose data it encrypted and stole between February and August 2024. They included organisations in water, healthcare, government, finance and transport.
RansomHub rose on the collapse of rivals. LockBit's takedown in February 2024 and ALPHV's disappearance a month later freed their affiliates. Many of them moved to RansomHub, which became the most active brand within months.
ZeroFox recorded the leak site going dark on 1 April 2025, with no victims posted afterwards. A DragonForce account then said RansomHub was shifting to DragonForce infrastructure, a claim ZeroFox could not substantiate.