RansomHouse

RansomHouse is a financially motivated cyber extortion and ransomware operation that emerged in late 2021. Known aliases include Jolly Scorpius, Ransom House, and related naming variants. The group initially distinguished itself by promoting an extortion-only model centered on data theft and public shaming of victims rather than file encryption, portraying itself as a "professional mediator" that exposes poor security practices. Over time, it evolved into a more conventional ransomware actor and has been associated with cryptographic lockers, including the Mario ESXi ransomware family, which has been linked to Babuk-derived code used against VMware ESXi environments. RansomHouse has targeted organizations across a wide range of sectors, including healthcare, government, retail, manufacturing, technology, cultural institutions, and critical infrastructure. Reported victims and claimed intrusions span hospitals and healthcare providers, cybersecurity vendors, automotive and commercial businesses, ticketing and cultural services, and public-sector entities. The group has also been associated with attacks affecting virtualized enterprise infrastructure and with incidents involving large-scale data exfiltration. Operationally, RansomHouse is best characterized as a data-theft-and-extortion actor that later incorporated encryption in at least some intrusions. It commonly seeks payment in exchange for suppressing publication or deleting stolen data rather than focusing solely on decryption. The group operates a leak site to pressure victims and has used staged proof disclosures and negotiation pressure tactics before full publication. Reporting has linked it to exploitation of exposed services, weak credentials, phishing, vulnerable remote access pathways, and opportunistic exploitation of known vulnerabilities, including cases where it may have leveraged high-profile edge-device flaws. RansomHouse has shown interest in VMware ESXi and other virtualized environments. Mario ESXi, associated with the group, shares code lineage with leaked Babuk source code, illustrating RansomHouse’s use or adaptation of existing ransomware tradecraft. The group has also been linked to tooling for both Windows and Linux environments and has been observed in intrusions where endpoint defense evasion played a role. Telemetry has placed RansomHouse intrusions alongside use of commercial EDR-killer tooling, indicating that affiliates or operators may disable security products prior to ransomware deployment or data theft. The group appears to operate within the broader ransomware affiliate ecosystem rather than as a purely standalone malware developer. It has been discussed alongside other major ransomware actors, and some reporting has suggested possible overlaps or loose links with other extortion brands, though such relationships are not consistently established at high confidence. RansomHouse is widely regarded as a criminal, not state-sponsored, threat actor. Overall, RansomHouse represents the evolution of modern ransomware from encryption-centric attacks toward hybrid extortion operations that combine credential abuse, intrusion into enterprise infrastructure, data exfiltration, leak-site coercion, and selective use of encryptors. Its activity demonstrates the convergence of pure extortion, virtualization-focused ransomware, and commercially sourced defense-evasion tooling in contemporary financially motivated intrusion operations.