Ransomware poses a significant threat to industries like finance, healthcare, and manufacturing, causing severe economic losses and security risks. Traditional defenses focus on preventing crypto ransomware, but double extortion ransomware, which involves both data encryption and leakage, leads to greater data loss and privacy risks. To address this issue, we propose RanHunter, a defense system designed to detect double extortion ransomware. RanHunter comprises two key components, RanNet, a file system monitoring model, and SafeZone, a secure storage solution for sensitive data protection. RanNet is a hybrid model integrating Residual Convolutional Blocks (RCB), Channel Attention, and Multi-Head Attention to detect ransomware activity by analyzing abnormal file system behaviors. The RCB component captures local anomalies in file system activities, such as excessive file reads and queries, while Channel Attention enhances important channel features and suppresses less relevant ones. Meanwhile, Multi-Head Attention models global changes, identifying dispersed ransomware behaviors and improving detection accuracy. Additionally, SafeZone is designated for storing sensitive files, where critical data is securely encrypted and backed up within this protected area, ensuring both confidentiality and resilience against unauthorized access. Experimental results show that RanHunter achieves an accuracy of 99.17%, outperforming the state-of-the-art model by 5.92%.