ransomware

RansomHouse

activeAttribution: ModeratePlausible and partly corroborated — some gaps or single-source elements.

Ransomware

White RabbitMario ESXi

Attribution

Unattributed financially motivated cybercrime group; no confirmed nation-state or named-crew attribution in public reporting. Cyberint used a Doc2Vec ransom-note comparison to identify a ~99% linguistic match between RansomHouse and the later 8Base group, suggesting affiliation, shared operators, or a copycat relationship, but the exact overlap remains unconfirmed. English is the primary operating language of the group's communications and leak site.

First seen

2021-12

Last active

2026-09

Motivation

Financial (data-theft extortion / double extortion)

Attribution confidence

medium

MENA targeting

Saudi Arabia, Egypt

Sectors

Manufacturing, hospitality

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

Why it mattersRansomware actor, medium confidence, documented targeting Saudi Arabia, Egypt (Manufacturing, hospitality sectors).

What's nextNo pipeline reports reference this actor yet — Radar mentions may still surface early signal.

Associated with

Related to

SpacebearsactorTechnique overlap
IncRansomactorTechnique overlap
CactusactorTechnique overlap
KillSecactorTechnique overlap
SinobiactorTechnique overlap
BianLianactorTechnique overlap
Hunters InternationalactorTechnique overlap
Moses StaffactorTechnique overlap
Cicada3301

Coverage robustness · vs this actor

How evasion-resistant our detection coverage is against RansomHouse's techniques — Summiting the Pyramid scores analytics (1 brittle – 5 robust); the actor inherits through its TTPs. This is a detection-engineering metric, not an attribution signal — see Attribution for confidence.

Techniques with a robust rule

Techniques with any detection

11 / 16

Mean robustness (of covered)

2.1

Useful?