---
title: RansomHub Affiliate Uses Custom Betruger Backdoor
description: A RansomHub affiliate has deployed a new multi-function backdoor, dubbed Betruger, in recent attacks, showcasing an innovative approach to streamline ransomware operations.
---

[Insights, news, education and announcements from PolySwarm](https://blog.polyswarm.io)

# [RansomHub Affiliate Uses Custom Betruger Backdoor](https://blog.polyswarm.io/ransomhub-affiliate-uses-custom-betruger-backdoor)

 Written by [The Hivemind](https://blog.polyswarm.io/author/the-hivemind) | Mar 28, 2025 5:37:43 PM

**Related Families:** RansomHub  
**Verticals Targeted:** Healthcare, Government, Critical Infrastructure 

## **Executive Summary**

## A RansomHub affiliate has deployed a new multi-function backdoor, dubbed Betruger, in recent attacks, showcasing an innovative approach to streamline ransomware operations. This development signals an escalation in the group’s tactics, targeting critical infrastructure with a consolidated toolset designed to evade detection.

**Key Takeaways**

- Betruger, a custom backdoor, integrates multiple pre-ransomware functionalities, including keylogging, credential dumping, and privilege escalation, into a single executable.
- RansomHub affiliates exploit vulnerabilities such as CVE-2022-24521 and CVE-2023-27532 to deploy Betruger, targeting U.S. critical infrastructure sectors like healthcare and government.
- The backdoor masquerades as legitimate applications to blend into victim environments.
- Observed use of Bring Your Own Vulnerable Driver (BYOVD) techniques, such as EDRKillshifter, enhances the group’s ability to disable endpoint security solutions.
- Based on the discovery of this backdoor and an escalation in targeting of critical infrastructure entities, PolySwarm analysts classify RansomHub as an evolving threat and Betruger as an emerging threat. 

**What is Betruger?**

The RansomHub RaaS operation has solidified its position as a dominant force in the ransomware landscape since emerging in February 2024. By Q3 2024, it claimed the highest number of attacks among ransomware groups, a feat driven by lucrative affiliate terms and a growing arsenal of tools. The latest addition, identified as Backdoor.Betruger, marks a significant evolution in their methodology. Unlike typical ransomware campaigns that lean on widely available tools like Cobalt Strike or Mimikatz, Betruger is a bespoke creation tailored for efficiency and stealth. Symantec [reported](https://www.security.com/threat-intelligence/ransomhub-betruger-backdoor) on Betruger.

Betruger consolidates an array of capabilities typically spread across multiple tools. Technical analysis reveals it supports keylogging, network scanning, privilege escalation, credential dumping, screenshot capture, and file uploads to command-and-control (C2) servers. This all-in-one design minimizes the number of artifacts dropped on a victim’s network, reducing the attack’s footprint and complicating detection efforts. To further disguise its presence, the backdoor is deployed under filenames such as \`mailer.exe\` and \`turbomailer.exe\`, mimicking legitimate mailing applications despite lacking any such functionality.

The infection chain often begins with phishing or exploitation of known vulnerabilities. Notably, RansomHub affiliates have leveraged [CVE-2022-24521](https://nvd.nist.gov/vuln/detail/cve-2022-24521), a Windows privilege escalation flaw, and [CVE-2023-27532](https://nvd.nist.gov/vuln/detail/cve-2023-27532), a Veeam backup credential leak vulnerability, to gain initial access and escalate privileges. These exploits have been instrumental in targeting U.S. critical infrastructure, with healthcare, government, and other high-value sectors bearing the brunt of attacks. Beyond Betruger, affiliates employ advanced tactics like BYOVD, with tools such as EDRKillshifter disabling endpoint detection and response (EDR) solutions. Based on the discovery of this backdoor and an escalation in targeting of critical infrastructure entities, PolySwarm analysts classify RansomHub as an evolving threat and Betruger as an emerging threat. 

**IOCs**

PolySwarm has a sample of Betruger.

 

[ae7c31d4547dd293ba3fd3982b715c65d731ee07a9c1cc402234d8705c01dfca](https://polyswarm.network/scan/results/file/ae7c31d4547dd293ba3fd3982b715c65d731ee07a9c1cc402234d8705c01dfca)

 

You can use the following CLI command to search for all Betruger samples in our portal:

**$ polyswarm link list -f Betruger**

***Don’t have a PolySwarm account? Go* [here](https://polyswarm.network/) *to sign up for a free Community plan or subscribe.***

***Contact us at* [hivemind@polyswarm.io](mailto:hivemind@polyswarm.io) *| Check out our* [blog](https://blog.polyswarm.io/) ***|* **[Subscribe](https://polyswarm.io/ransomwarereport/) *to our reports.***

[View full post](https://blog.polyswarm.io/ransomhub-affiliate-uses-custom-betruger-backdoor)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "The Hivemind"
  },
  "dateModified" : "2025-03-28T17:46:11.522Z",
  "datePublished" : "2025-03-28T17:37:43Z",
  "headline" : "RansomHub Affiliate Uses Custom Betruger Backdoor",
  "image" : {
    "@type" : "ImageObject",
    "height" : 900,
    "url" : "https://5737925.fs1.hubspotusercontent-na1.net/hubfs/5737925/Threat%20Bulletin%20Images/RANSOMHUB-1.jpg",
    "width" : 1600
  },
  "mainEntityOfPage" : "https://blog.polyswarm.io/ransomhub-affiliate-uses-custom-betruger-backdoor",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60.0,
      "url" : "https://cdn2.hubspot.net/hubfs/5737925/Social%20Icons_PS-1.png",
      "width" : 59.820896
    },
    "name" : "The PolySwarm Blog"
  }
}
```