Loading malware…
RansomHouse is a ransomware-as-a-service (RaaS) operation associated with the threat group Jolly Scorpius. First observed in 2021, it initially used an extortion-only model centered on data theft and threats to leak stolen information, and later evolved to include file encryption as part of a double-extortion model. The operation has publicly listed at least 123 victims on its leak site since December 2021 and has impacted organizations in healthcare, finance, transportation, and government.
RansomHouse targets Windows and Linux, with a notable focus on VMware ESXi environments to maximize disruption by encrypting large numbers of virtual machines simultaneously. Initial access has been reported via spear phishing, social engineering, exploitation of vulnerable systems, Log4Shell, or through initial access brokers. Post-compromise activity described in the content includes use of Cobalt Strike for persistence and Rclone for data exfiltration.
Its tooling includes a management/deployment component called MrAgent and an encryptor called Mario. MrAgent is used to automate ransomware deployment across ESXi environments, maintain persistent C2 connectivity, collect host information, disable the ESXi firewall, and execute commands including stopping vCenter remote management and initiating VM encryption. Mario targets virtualization- and backup-related file types including ova, ovf, vbk, vbm, vib, vmdk, vmem, vmsd, vmsn, and vswp. It drops a ransom note named "How To Restore Your Files.txt" and renames encrypted files with extensions containing "mario"; the content also notes .RH extensions in some reporting.
Recent reporting in the content states that RansomHouse upgraded its encryption from a simpler single-pass approach to a more complex dual-key, two-stage process using a 32-byte primary key and an 8-byte secondary key, along with dynamic chunk processing and sparse encryption. This upgrade was described as a significant escalation that complicates analysis and decryption. The malware is written in Golang according to the provided content.
The content also notes that RansomHouse has been referenced in reporting on Iranian actors partnering with affiliates of the NoEscape, RansomHouse, and AlphV ransomware operations and taking a percentage of ransom payments. In 2025, the content states RansomHouse hit at least five healthcare entities, including a U.S. hospital chain in March and a European clinic in May. A sample of MrAgent associated with this activity is identified in the content with SHA-256: 8189c708706eb7302d7598aeee8cd6bdb048bf1a6dbe29c59e50f0a39fd53973.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
I conducted a retrospective study on the vulnerability CVE-2023-4966, commonly known as Citrix Bleed, which allows attackers to easily bypass authentication in Citrix's Citrix ADC and Citrix Gateway products, over the course of six months. Initially exploited by some attackers as a zero-day in August 2023, a patch was released on October 10, followed by the publication of a PoC in late October, after which various attackers exploited the vulnerability.
"A critical remote code execution (RCE) vulnerability, identified as CVE-2025-55182 and dubbed React2Shell, exists within the React Server Components (RSC) architecture, allowing unauthenticated attackers to execute arbitrary code..."
3 distinct techniques documented for this family, organized by ATT&CK tactic.
17 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Ransomware operation whose affiliates were reportedly partnered with Iranian actors for financially motivated activity.
Ransomware/extortion operation referenced as having affiliates that partnered with Iranian actors for monetization.
Ransomhouse is a Ransomware-as-a-Service (RaaS) operation that targets organizations, particularly those using VMware ESXi infrastructure, with advanced dual-key encryption and double extortion tactics (encryption and data theft).
Ransomware/extortion brand listed among malware observed/associated with React2Shell exploitation activity (no additional campaign detail provided in the content).
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.