MalwareRansomwareUsed by 1 actor

Mario ESXi

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

RansomHouse

RansomHouse is a sophisticated ransomware-as-a-service (RaaS) group known for deploying a unique ransomware variant called Mario ESXi, whose code shares lineage with the leaked Babuk ransomware source code, alongside a tool called MrAgent to target both Windows and Linux-based virtualized environments.

via cyber security newscybersecuritynews.com

MITRE ATT&CK

Techniques & procedures

5 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1078Valid AccountsEvidence1

TacticsInitial Access Persistence Privilege Escalation Stealth

The group typically targets VMware ESXi infrastructure and exploits weak domain credentials and monitoring systems to gain privileged access.

T1190Exploit Public-Facing ApplicationEvidence1

TacticInitial Access

“The threat actor eventually revealed the attack on the victim's network started with an exploit in CITRIX remote access software…” / “Exploit Public-Facing Application Initial compromise through an exploit in Citrix”

Persistence

1 technique

T1078Valid AccountsEvidence1

TacticsInitial Access Persistence Privilege Escalation Stealth

The group typically targets VMware ESXi infrastructure and exploits weak domain credentials and monitoring systems to gain privileged access.

Privilege Escalation

1 technique

T1078Valid AccountsEvidence1

TacticsInitial Access Persistence Privilege Escalation Stealth

The group typically targets VMware ESXi infrastructure and exploits weak domain credentials and monitoring systems to gain privileged access.

Stealth

2 techniques

T1078Valid AccountsEvidence1

TacticsInitial Access Persistence Privilege Escalation Stealth

The group typically targets VMware ESXi infrastructure and exploits weak domain credentials and monitoring systems to gain privileged access.

T1497.001System ChecksEvidence1

TacticsStealth Discovery

The group typically targets VMware ESXi infrastructure ... alongside a tool called MrAgent to target both Windows and Linux-based virtualized environments.

Discovery

1 technique

T1497.001System ChecksEvidence1

TacticsStealth Discovery

The group typically targets VMware ESXi infrastructure ... alongside a tool called MrAgent to target both Windows and Linux-based virtualized environments.

Lateral Movement

1 technique

T1210Exploitation of Remote ServicesEvidence1

TacticLateral Movement

“…started with an exploit in CITRIX remote access software and VMware ESXi infrastructure… They exploited vulnerabilities in the virtualisation servers…”

Impact

1 technique

T1486Data Encrypted for ImpactEvidence2

TacticImpact

RansomHouse is a sophisticated ransomware-as-a-service (RaaS) group ... known for deploying a unique ransomware variant called Mario ESXi

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

cyber security newsNews

May 8, 2026

Trellix Breach - RansomHouse Claims Access to Parts of Source Code

A ransomware variant used by RansomHouse, targeting virtualized environments, particularly VMware ESXi infrastructure.

trellix blogNews

Mar 18, 2026

RansomHouse am See

Ransomware variant targeting ESXi (and referenced alongside Windows/Linux targeting) used by RansomHouse; described as sharing code with Babuk (likely derived from Babuk source leak) and deployed at scale via MrAgent to encrypt virtual machines and extort victims (double extortion).

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping5

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.