From Linear to Complex: An Upgrade in Ransom House Encryption
Summary: Unit 42 reports that RansomHouse, a ransomware-as-a-service operation run by the group it tracks as Jolly Scorpius, has upgraded its Mario encryptor from a single-pass linear routine to a two-stage scheme using both a 32-byte primary key and an separate 8-byte secondary key. The group, which uses double extortion and targets VMware ESXi to encrypt many virtual machines at once, had at least 123 victims listed on its data leak site since December 2021, with intrusions in healthcare, finance, transportation and government.
Bottom line: Recovery without paying now depends on holding both keys, and the group's ESXi focus means a single compromised hypervisor can lock dozens or hundreds of virtual machines at once.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026