RansomHouse

RansomHouse is a ransomware-as-a-service (RaaS) operation associated with the threat group Jolly Scorpius. First observed in 2021, it initially used an extortion-only model centered on data theft and threats to leak stolen information, and later evolved to include file encryption as part of a double-extortion model. The operation has publicly listed at least 123 victims on its leak site since December 2021 and has impacted organizations in healthcare, finance, transportation, and government.

RansomHouse targets Windows and Linux, with a notable focus on VMware ESXi environments to maximize disruption by encrypting large numbers of virtual machines simultaneously. Initial access has been reported via spear phishing, social engineering, exploitation of vulnerable systems, Log4Shell, or through initial access brokers. Post-compromise activity described in the content includes use of Cobalt Strike for persistence and Rclone for data exfiltration.

Its tooling includes a management/deployment component called MrAgent and an encryptor called Mario. MrAgent is used to automate ransomware deployment across ESXi environments, maintain persistent C2 connectivity, collect host information, disable the ESXi firewall, and execute commands including stopping vCenter remote management and initiating VM encryption. Mario targets virtualization- and backup-related file types including ova, ovf, vbk, vbm, vib, vmdk, vmem, vmsd, vmsn, and vswp. It drops a ransom note named "How To Restore Your Files.txt" and renames encrypted files with extensions containing "mario"; the content also notes .RH extensions in some reporting.

Recent reporting in the content states that RansomHouse upgraded its encryption from a simpler single-pass approach to a more complex dual-key, two-stage process using a 32-byte primary key and an 8-byte secondary key, along with dynamic chunk processing and sparse encryption. This upgrade was described as a significant escalation that complicates analysis and decryption. The malware is written in Golang according to the provided content.

The content also notes that RansomHouse has been referenced in reporting on Iranian actors partnering with affiliates of the NoEscape, RansomHouse, and AlphV ransomware operations and taking a percentage of ransom payments. In 2025, the content states RansomHouse hit at least five healthcare entities, including a U.S. hospital chain in March and a European clinic in May. A sample of MrAgent associated with this activity is identified in the content with SHA-256: 8189c708706eb7302d7598aeee8cd6bdb048bf1a6dbe29c59e50f0a39fd53973.