Mario’s Deadly Upgrade: RansomHouse Unveils Dual-Key Encryption to Defeat Backups and Recovery

RansomHouse’s Jolly Scorpius group has unveiled a major upgrade to its encryption engine, Mario, shifting from a simple linear model to a multi-layered, dynamic chunking approach designed to complicate analysis and defeat traditional backups and recovery. According to Unit 42 researchers, the malware now processes files in dynamic chunks with variable sizing, making static analysis and reverse engineering notably harder for defenders.

The most striking feature is a dual-key system that implements a two-factor encryption scheme, significantly increasing the difficulty of decryption without both keys and strengthening the attackers’ ransom capabilities. The report notes that Jolly Scorpius has long operated as a Ransomware-as-a-Service group and has claimed at least 123 victims since December 2021, targeting sectors including healthcare, finance, transportation and government with a classic double extortion model.

This evolution signals a shift towards more sophisticated, adaptive threats that could outpace conventional endpoint-defence measures, underscoring the push for dynamic, layered security strategies.