Loading malware…
MrAgent is a management, deployment, and persistence utility used by the RansomHouse ransomware-as-a-service operation, also associated in the provided content with Jolly Scorpius. It is used alongside the Mario ESXi ransomware and is designed to automate and track ransomware deployment at scale, particularly across VMware ESXi hypervisors and virtualized environments; the content also states it has been used to target both Windows and Linux-based systems. Reported behavior includes establishing persistent connections to attacker command-and-control servers, identifying hosts, retrieving local IP and host inventory, collecting hypervisor and virtual machine information, disabling the ESXi firewall, executing received commands, and orchestrating Mario ransomware execution to encrypt critical VM files. Described C2 communications use JSON over sockets with a passphrase and heartbeat messages, and documented commands include info, config, exec, run, remove, abort, abort_f, quit, and welcome. The content further notes that Exec-related actions can include changing the root password, stopping vCenter remote management via /etc/init.d/vpxa stop, and starting VM encryption. A Windows variant with broadly similar logic is also described, with some ESXi-specific functionality removed and several functions implemented through PowerShell, including log clearing and file removal. MrAgent is central to large-scale attacks against ESXi infrastructure, which RansomHouse affiliates target to encrypt many virtual machines simultaneously. Associated indicators explicitly mentioned in the content are the ESXi MrAgent SHA-256 8189c708706eb7302d7598aeee8cd6bdb048bf1a6dbe29c59e50f0a39fd53973 and the Windows MrAgent SHA-256 bfc9b956818efe008c2dbf621244b6dc3de8319e89b9fa83c9e412ce70f82f2c.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
RansomHouse is a sophisticated ransomware-as-a-service (RaaS) group known for deploying a unique ransomware variant called Mario ESXi, whose code shares lineage with the leaked Babuk ransomware source code, alongside a tool called MrAgent to target both Windows and Linux-based virtualized environments.
10 distinct techniques documented for this family, organized by ATT&CK tactic.
The group typically targets VMware ESXi infrastructure and exploits weak domain credentials and monitoring systems to gain privileged access.
“The threat actor eventually revealed the attack on the victim's network started with an exploit in CITRIX remote access software…” / “Exploit Public-Facing Application Initial compromise through an exploit in Citrix”
“Run… used to run arbitrary commands on the ESXi host… written to the file ‘./shmv’ … executed.” / “several functions… replaced by PowerShell alternatives… wevtutil… Remove-Item… Get-WmiObject…”
The group typically targets VMware ESXi infrastructure and exploits weak domain credentials and monitoring systems to gain privileged access.
“When configured to do so; the binary will start by changing the root password of the local hypervisor.”
The group typically targets VMware ESXi infrastructure and exploits weak domain credentials and monitoring systems to gain privileged access.
“When configured to do so; the binary will start by changing the root password of the local hypervisor.”
“Remove… remove a file… ‘rm -rf FILE’” / “Files are removed… PowerShell Remove-Item” / “Quit… kill and remove the binary… ‘rm -f’”
The group typically targets VMware ESXi infrastructure and exploits weak domain credentials and monitoring systems to gain privileged access.
The group typically targets VMware ESXi infrastructure ... alongside a tool called MrAgent to target both Windows and Linux-based virtualized environments.
“Disable the ESXi firewall by executing the command ‘esxcli network firewall set --enabled false’”
“Retrieve the local IP address… Retrieve the MAC address…” / “System Network Configuration Discovery Retrieves MAC and IP address…”
The group typically targets VMware ESXi infrastructure ... alongside a tool called MrAgent to target both Windows and Linux-based virtualized environments.
“…started with an exploit in CITRIX remote access software and VMware ESXi infrastructure… They exploited vulnerabilities in the virtualisation servers…”
“Messages to and from the command & control server are transmitted as JSON encoded strings…” / “Application Layer Protocol Utilized MrAgent for bot communication”
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.