Loading threat actor…
RansomHouse, also tracked as Jolly Scorpius and referred to as Ransom House or RansomHouse Group, is a financially motivated cybercriminal extortion group active since late 2021. It initially emphasized stealing corporate data and demanding payment to prevent disclosure, publicly claiming not to encrypt victim systems. Its operations subsequently expanded to include encryption and double extortion, with Mario ransomware associated with the group. RansomHouse maintains a dedicated leak site to name victims and publish stolen information. The group targets corporate organizations across sectors including healthcare, food production and logistics, retail, automotive services, and information technology. Its targeting includes organizations in the United States and Japan, including Japanese retailer Askul. It has also publicly claimed responsibility for the attack against Japanese refrigerated logistics company Nichirei, although the company did not independently attribute that incident to RansomHouse. RansomHouse gains initial access by exploiting vulnerabilities in corporate environments. Observed intrusion activity includes bypassing MFA through non-interactive sessions, obtaining credentials through DCSync, and using SSH and RDP for lateral movement. Its intrusions have also involved endpoint-defense impairment, including commercial EDR-killing tooling and bring-your-own-vulnerable-driver techniques. Data exfiltration and threats of public disclosure remain central to its extortion model.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
31 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
5 malware families Mallory has associated with this actor across public reporting.
2 CVEs Mallory has associated with this actor across public reporting. 2 of them are exploited in the wild (not necessarily by this actor).
3 indicators attributed to this actor. Values are masked here and available in full in Mallory.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.