RansomHouse is a cybercrime operation that emerged in late 2021, initially distinguishing itself by specializing in data exfiltration and extortion rather than encryption, portraying itself as a 'professional mediator' exposing security flaws in victim organizations, a facade for financial gain. The group has since evolved to incorporate encryption, particularly targeting VMware ESXi environments, and operates under a Ransomware-as-a-Service (RaaS) model with a clear division of labor between operators and affiliates. While unconfirmed, the group is believed to originate from Russia, with evidence suggesting Russian-speaking actors and alignment, as indicated by C2 infrastructure and support from pro-Russian media. RansomHouse is also tracked by some researchers under the alias Jolly Scorpius and has been linked to, or reused tools associated with, other groups like White Rabbit and Mario ESXi.

Aliases del actor

Jolly Scorpius"AMD"se asocia con dominios como techcrunch

Actores similares

contiransomware · 351ContFRthreat-actor · 2not-consistently-used---mactor · 1iocontrolactor · 1apt-desertfalconactor · 1backconfigactor · 1redcontroleactor · 1apt-stealthfalconactor · 1Container and Resource Discoveryactor · 1Data from Configuration Repositoryactor · 1