From Linear to Complex: An Upgrade in RansomHouse Encryption

RansomHouse is a ransomware-as-a-service (RaaS) operation run by a group that Unit 42 tracks as Jolly Scorpius, and recent samples show a significant upgrade in its encryption. The threat group uses a double extortion approach, combining data theft with threats to leak stolen information, and at the time of writing at least 123 victims are listed on the RansomHouse data leak site since December 2021.

The attack chain involves three roles—Operator, Attacker, and Victim—and focuses on VMware ESXi infrastructure to enable rapid encryption across multiple virtual machines. The encryption upgrade moves from a simple linear method to a two-factor, multi-layered scheme, with Mario as the encryptor and MrAgent as the deployment tool that compromises ESXi hosts and manages data exfiltration before encryption.

Two versions of Mario have been identified, showing a shift to chunked file processing, dynamic sizing, and a more robust output format designed to complicate static analysis. Palo Alto Networks highlights that these developments underscore the need for adaptive, threat-informed defensive measures, and offers guidance centred on their Advanced WildFire, Cortex Xpanse and XSIAM products to help detect exposed ESXi infrastructure.