RansomHub ransomware group lists phaus.us&phakr.com&phabodysystems.com on its leak site

• Ransomware group: RansomHub
• Country: United States
• Announcement date: March 28, 2025

RansomHub claims a data breach against multiple domains

The ransomware group known as RansomHub has officially listed several domains on its leak site, including phaus.us, phakr.com, and phabodysystems.com. This announcement, made on March 28, 2025, serves as a claim of a successful cyberattack and subsequent data breach against the targeted entities. While the group has publicized these domains, the specific details regarding the total volume of compromised data and the specific ransom demand remain undisclosed in the public announcement.

Ransomware attacks often involve a tactic known as double extortion. In these scenarios, threat actors do not merely encrypt an organization's files to disrupt operations; they also exfiltrate sensitive information before the encryption process begins. The threat of leaking this stolen data on a public leak site serves as additional leverage to pressure the victim into paying a ransom. By publishing specific details, the group aims to increase the visibility of the breach and maximize the reputational damage to the target organization.

Details of the alleged incident

According to the announcement posted by RansomHub, the group claims to have gained unauthorized access to the organization's data. The claim of a breach is supported by the publication of specific personal information belonging to a high-ranking official within the organization. However, the group has not provided any information regarding the total size of the data stolen or the specific nature of other files that may have been accessed during the intrusion.

The information released by the threat actor is focused on the following:

• Executive contact information

Specifically, the leaked data reportedly includes the president's name, job title, business phone number, fax number, email address, and mobile number. There is no clear information provided in the announcement regarding any other types of data that may have been compromised during this alleged incident.

Analysis of the threat actor and potential impact

RansomHub is identified as a Ransomware-as-a-Service (RaaS) group. This business model allows developers to lease their ransomware code to affiliates, who then carry out the actual attacks. RansomHub emerged in early 2024 and has been reported to attract former affiliates from the ALPHV group. Although reports suggest the group may have ceased operations in early 2025, the threat they pose through their established infrastructure remains a significant concern for cybersecurity professionals.

The exposure of executive contact information presents a specific set of risks. When a high-level official's personal and professional details are leaked, it creates a prime opportunity for targeted phishing attacks, also known as spear-phishing. Attackers can use the stolen name, title, and contact details to craft highly convincing messages designed to deceive employees or other business partners. Furthermore, such information can be exploited for identity theft attempts or social engineering campaigns aimed at gaining deeper access to the organization's internal network.

Recommended defensive measures

For organizations operating in the United States, such as the entities involved in this incident, a breach of this nature may trigger notification obligations under various state laws and federal data protection regulations. It is often advisable for organizations to conduct a comprehensive forensic investigation to determine the full scope of the breach and identify exactly what data was accessed or exfiltrated.

To mitigate the risks associated with such leaks, organizations should consider implementing robust security awareness training to help employees recognize sophisticated phishing attempts. Additionally, enforcing multi-factor authentication (MFA) across all corporate accounts and implementing strict identity and access management (IAM) protocols can help limit the potential impact of compromised credentials. Monitoring for unusual activity within the network and maintaining regular, offline backups are also critical components of a modern cybersecurity defense strategy.