ESET profiles RansomHub as the dominant ransomware-as-a-service group that rose after law-enforcement disruption of LockBit and BlackCat. The research links RansomHub activity to tooling trails associated with Play, Medusa, and BianLian affiliates and documents EDRKillShifter, a custom EDR-killer component used by RansomHub affiliates. EDRKillShifter uses a builder-generated 64-character password that protects each encryptor and blocks researchers from retrieving targeted process names or the abused vulnerable driver without the affiliate-specific password. The excerpt does not make a DPRK connection, so it should be handled as ransomware ecosystem context rather than North Korea attribution.