RansomHouse RaaS Service Upgraded with Double Extortion Strategy that Steals and Encrypt Data

RansomHouse (Jolly Scorpius) is a ransomware-as-a-service operation that combines data theft and encryption to extort victims; it uses MrAgent for deployment and the Mario encryptor which employs two-stage, sparse chunked encryption and targets VMware ESXi hypervisors to encrypt large numbers of virtual machines. The campaign has affected at least 123 organizations across critical sectors (healthcare, finance, transportation, government) since December 2021, demonstrating high sophistication and significant operational impact.