LIVE Threat Watch 36 actively exploited vulnerabilities added in the last 30 days. Latest: CVE-2026-118527 in Ivanti Connect Secure See all live vulnerabilities
+44 1865 950 828 Secure Your Business
ActiveVendor Research

RansomHouse

A ransomware-as-a-service operation that has listed victims since December 2021. Its affiliates steal data and target VMware ESXi hypervisors, using automation to encrypt many virtual machines at once.

Threat actor profile. Last reviewed 3 November 2026.

Overview

Why It Matters

The defining feature is virtualisation. Unit 42 says affiliates specifically target ESXi, because compromising one hypervisor lets them encrypt many virtual machines at once. Its Mario encryptor also targets virtualisation and backup files, which hinders recovery.1

Trellix and Northwave documented MrAgent, a tool that automates and tracks deployment across hypervisors. It can disable the ESXi firewall, change the root password and end non-root SSH sessions.2 Unit 42 reported a more complex Mario encryption routine in December 2025, which makes analysis harder but leaves the result the same.1

The sources reviewed do not establish a UK link. Trellix reported the US as the main target in 2023.2

Our View

Hypervisor access is the point of concentration here. We would treat ESXi management interfaces and the credentials for them as tier zero, and keep backups out of their reach.

Attack Chain

How It Attacks

Based on Unit 42's description of the operation1 and the case study from Trellix and Northwave.2

  1. 1

    Get In

    Affiliates gain access through phishing or exploits. In one case the actor said it used an exploit in Citrix remote access software and VMware ESXi infrastructure.

  2. 2

    Take Control of the Domain

    Gains system rights and domain accounts, deploys backdoors, and abuses weak domain credentials used for backup storage.

  3. 3

    Steal the Data

    Sends data out to file-sharing or cloud services such as MEGA.

  4. 4

    Prepare the Hypervisors

    Runs MrAgent to disable the ESXi firewall, change the root password, stop the vCenter agent and end non-root SSH sessions.

  5. 5

    Encrypt at Scale

    Shuts down virtual machines and encrypts their files, along with backup files, using Mario.

  6. 6

    Extort

    Negotiates through a Tor chat and publishes stolen data from non-payers on its leak site.

MITRE ATT&CK

Key Techniques

ATT&CK v20 has no group entry for RansomHouse. This mapping is ours, based on Unit 421 and Trellix.2

IDTechniqueTacticWhat It Looks Like
T1566PhishingInitial AccessAffiliates use phishing for access.
T1190Exploit Public-Facing ApplicationInitial AccessAffiliates use exploits, including a reported Citrix exploit in one case.
T1567.002Exfiltration to Cloud StorageExfiltrationSends data to MEGA and similar services.
T1686Disable or Modify System FirewallDefence ImpairmentMrAgent disables the ESXi firewall.
T1531Account Access RemovalImpactMrAgent can change the root password.
T1489Service StopImpactMrAgent can stop the vCenter agent.
T1486Data Encrypted for ImpactImpactMario encrypts virtual machine files.
Tooling

Tools Observed

Custom Tools

MrAgentMario

Data Theft

MEGAput.io

From Unit 421 and Trellix.2 MEGA and put.io are legitimate services.

Vulnerabilities

The sources reviewed name no specific CVE. Trellix's case study records only the actor's own statement about a Citrix and ESXi exploit.2

History

Key Events

  1. The group emerges, listing victims from December.2,1

  2. Trellix and Northwave publish their MrAgent case study.2

  3. Unit 42 reports an upgraded Mario encryption routine.1

  4. BleepingComputer reports a new claim by the group, which it could not verify.3

Detection

Warning Signs

Our inference from the MrAgent behaviour Trellix describes.2 None of these proves an attack alone.

  • Unexpected ESXi firewall changes
  • The vCenter agent stopping without a change ticket
  • Mass termination of SSH sessions on a hypervisor
  • A changed root password or console welcome message
  • Large uploads to file-sharing services from servers
What To Do

Defences That Matter

Harden the Hypervisors

  • Isolate ESXi management from the general network.
  • Require strong authentication for hypervisor and vCenter administration.
  • Segment networks, as Trellix recommends.2
Zero trust architecture

Strengthen Access

  • Enhance two-factor authentication.2
  • Stop exposing RDP and retire outdated SMB.2
  • Use strong, separate credentials for backup storage.
Identity security and PAM

Plan for Losing the Hypervisor

  • Keep immutable backups outside the reach of domain and ESXi credentials.
  • Test rebuilding hosts from clean media.
Business continuity and disaster recovery

Test the Path

  • Run regular red team tests, as Trellix recommends.2
Red and purple teaming

How Far Could an Attacker Get From One Hypervisor?

We can test your virtualisation and backup controls against the methods in this profile and help you close the gaps.

Talk to Our Team
Evidence

Sources

  1. Unit 42, Palo Alto Networks: From Linear to Complex: An Upgrade in RansomHouse Encryption, 17 December 2025
  2. Trellix: RansomHouse am See, 14 February 2024
  3. BleepingComputer: report on a source code breach claimed by RansomHouse, 8 May 2026

MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. ATT&CK terms of use.