RansomHouse
Attribution profile
- Type
- Criminal
- Location
- Russia
- Known incidents
- 21 incidents
- Sources
- 14 sources
- First seen
- 2021-02-01
- Last seen
- 2026-07-13
- Updated
- 2026-10-13 06:45
- Aliases
- 1 alias
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
RansomHouse, also known as the Ransom House gang, is a financially motivated extortion group believed to be based in Russia that describes itself as a "professional mediators community" targeting organizations with allegedly negligent data‑protection practices. The group has hit a wide range of sectors—including healthcare (Mission Community Hospital, Hospital Clínic de Barcelona, Keralty), payment processing (AvidXchange), food logistics (Nichirei), pharmaceuticals (Eisai, IPCA Laboratories), retail (Shoprite), and manufacturing (Radley London, Cospec Srl)—across regions such as Japan, the United States, Italy, Spain, Colombia, South Africa, and India. Its operations typically involve data exfiltration (often hundreds of gigabytes to multiple terabytes) coupled with system encryption, using a WhiteRabbit‑derived ransomware encryptor that appends extensions such as ".mario" and drops ransom notes named "How To Restore Your Files.txt." Initial access has been observed through exploitation of network and VMware vulnerabilities, and the group also claims responsibility for source‑code repository intrusions. RansomHouse follows a double‑extortion model, threatening to publish stolen data on its dark‑web leak site unless a payment is made, and it has publicly claimed responsibility for high‑profile incidents such as the July 2026 Nichirei attack that disrupted refrigerated warehouses and the May 2026 Trellix source‑code breach.
Incidents
Attributed incidents are available to members.
21 incidentsSources
Sources available to members: 14 sources.