RansomHouse RaaS upgrades encryption to enhance effectiveness

Rafi Mahmood

Observed in the wild

• On 17 December, Palo Alto Networks disclosed that RansomHouse, a ransomware-as-a-service (RaaS) group operated by Jolly Scorpius, has upgraded its encryption from a simple linear method to a complex multi-layered scheme, significantly increasing resilience against analysis and recovery.
• The group targets VMware ESXi environments, deploying the tool "MrAgent" for persistent control and the "Mario" encryptor to lock virtual machine files, enabling mass disruption. The upgraded Mario version uses dual encryption keys, dynamic chunk processing, and selective file encryption, making decryption without both keys nearly impossible.
• Organisations are advised to patch ESXi systems, restrict access to hypervisors, and implement EDR/XDR solutions to detect lateral movement and ransomware deployment.

From Linear to Complex: An Upgrade in RansomHouse Encryption