Malware1 associated actor

Mario ESXi

Tracked since Mar 18, 2026 · Updated 7 months ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 daysNo mention activity in the last 30 days.

Vulns0Associated

Actors1Associated

ATT&CK5Techniques

IOCs0Tracked

Is this in your environment?See whether this family's indicators match your telemetry and which of your assets are exposed to the CVEs associated with it.

Check your exposure

Threat actors

Associated threat actors

1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details →

RansomHouse

RansomHouse is a sophisticated ransomware-as-a-service (RaaS) group known for deploying a unique ransomware variant called Mario ESXi, whose code shares lineage with the leaked Babuk ransomware source code, alongside a tool called MrAgent to target both Windows and Linux-based virtualized environments.

via cyber security newscybersecuritynews.com

MITRE ATT&CK

Techniques & procedures

5 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1078Valid AccountsEvidence1

The group typically targets VMware ESXi infrastructure and exploits weak domain credentials and monitoring systems to gain privileged access.

T1190Exploit Public-Facing ApplicationEvidence1

“The threat actor eventually revealed the attack on the victim's network started with an exploit in CITRIX remote access software…” / “Exploit Public-Facing Application Initial compromise through an exploit in Citrix”

Persistence

1 technique

T1078Valid AccountsEvidence1

The group typically targets VMware ESXi infrastructure and exploits weak domain credentials and monitoring systems to gain privileged access.

Privilege Escalation

1 technique

T1078Valid AccountsEvidence1

The group typically targets VMware ESXi infrastructure and exploits weak domain credentials and monitoring systems to gain privileged access.

Stealth

2 techniques

T1078Valid AccountsEvidence1

The group typically targets VMware ESXi infrastructure and exploits weak domain credentials and monitoring systems to gain privileged access.

T1497.001System ChecksEvidence1

The group typically targets VMware ESXi infrastructure ... alongside a tool called MrAgent to target both Windows and Linux-based virtualized environments.

Discovery

1 technique

T1497.001System ChecksEvidence1

The group typically targets VMware ESXi infrastructure ... alongside a tool called MrAgent to target both Windows and Linux-based virtualized environments.

Lateral Movement

1 technique

T1210Exploitation of Remote ServicesEvidence1

“…started with an exploit in CITRIX remote access software and VMware ESXi infrastructure… They exploited vulnerabilities in the virtualisation servers…”

Impact

1 technique

T1486Data Encrypted for ImpactEvidence2

RansomHouse is a sophisticated ransomware-as-a-service (RaaS) group ... known for deploying a unique ransomware variant called Mario ESXi

Activity feed

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

View more in app →

cyber security newsNews · May 8, 2026Trellix Breach - RansomHouse Claims Access to Parts of Source CodeA ransomware variant used by RansomHouse, targeting virtualized environments, particularly VMware ESXi infrastructure.Read more ↗trellix blogNews · Mar 18, 2026RansomHouse am SeeRansomware variant targeting ESXi (and referenced alongside Windows/Linux targeting) used by RansomHouse; described as sharing code with Babuk (likely derived from Babuk source leak) and deployed at scale via MrAgent to encrypt virtual machines and extort victims (double extortion).Read more ↗

Is this in your environment?See whether this family's indicators match your telemetry and which of your assets are exposed to the CVEs associated with it.

Check your exposure

Mallory platform

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start Free Trial Open in App ↗

IOC matchingMatch every observed IP, domain, and hash against your live telemetry.

Associated threat actors1Groups linked to this family, with evidence pinned to each claim.

Associated vulnerabilitiesCVEs linked to this family, with the reporting behind each link.

Detection signaturesYARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping5Every documented technique, ranked by evidence weight.

Researcher chatterReddit, Mastodon, and CTI community discussion around this family.

Mario ESXi

Tracked since Mar 18, 2026 · Updated 7 months ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 daysNo mention activity in the last 30 days.

Vulns0Associated

Actors1Associated

ATT&CK5Techniques

IOCs0Tracked

Is this in your environment?See whether this family's indicators match your telemetry and which of your assets are exposed to the CVEs associated with it.

Check your exposure