RansomHouseThreat actor
This group started operating during the first quarter of 2022. They published samples of alleged stolen data from companies on their site on Tor. It is unclear if they conducted the attacks themselves, or if they bought leaked databases from third parties.From MISP Galaxy
Last reported 13 days ago, by AhnLab ASEC6 reports
ATT&CK techniques
6 of 25 · each with the sentence it comes from- T1014Rootkit
“…g Your Own Vulnerable Driver (BYOVD), también vemos a los atacantes abusar con frecuencia de utilidades legítimas de anti‑rootkit o utilizar enfoques driverless para bloquear la comunicación del software de endpoint detection and response (EDR) o suspenderlo…”
- T1027Obfuscated Files or Information
“T1027”
- T1027.002Software Packing
“T1027.002”
- T1027.005Indicator Removal from Tools
“T1027.005”
- T1027.009Embedded Payloads
“T1027.009”
- T1037Boot or Logon Initialization Scripts
“Boot or Logon Initialization Scripts: Logon Script (Windows)”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
6 reports, newest first · the exact sentence from each-
September 2026 Threat Trend Report on Ransomware“In September 2026, groups such as The Gentlemen, Qilin, Metaencryptor, CL0P, Storm, AUDIT TEAM, LockBit, EMPERADOR, and RansomHouse were active, and new groups like Vladivostok, Vexy, and BlackLocks also emerged.”
-
September 2026 Dark Web Threat Actor Trend Report“…age namibia Nepal Netherlands NightmareStresser Oleksii-Lytvynenko Operation-PowerOFF Pepijn-van-der-Stap Poland PwnForums RaidForums RansomHouse Ransomware RBL-LEVIATHAN-GHOST Ryuk Sality Saudi-Arabia seizure Sentencing ShinyHunters source-code-leak supply-chain-attack T1ER0NE T…”
-
‘A treasure trove of information:’ Cybersecurity specialist says sensitive McMinnville records exposed online“The attack was claimed by RansomHouse, who leaked the data in August.”
-
Cyber Brief 26-06 - May 2026“Cybercrime actor RansomHouse claimed responsibility.”
-
EDR killers explicados: Más allá de los drivers“… las bandas Qilin, Akira y Gentlemen, y también lo observamos desplegado en una ocasión durante una intrusión de RansomHouse.”
-
EDR killers explained: Beyond the drivers“… that DemoKiller has been used by affiliates of the Qilin, Akira, and Gentlemen gangs, and we also observed it deployed once during a RansomHouse intrusion.”
Indicators in its reports
named in the reports above- 82ed942a52cdcf12…ba37619661a3in 2 reports
- 54547180a99474b0…8f3eea78b531in 2 reports
- 75f85caea52fe5a1…bd3161690addin 2 reports
- 002573d80091f7f8…2b85fa915f19in 2 reports
- 1e7567c0d525ad03…f40541994411in 2 reports
- 65c2388b0afb1d1f…d8d6cd8b5645in 2 reports
- a9f37104d2d89051…bff44d147e67in 2 reports
- 083f604377d74c43…e34ad7daceeain 2 reports
- 570161a420992280…800296b72d1cin 2 reports
- bbe0e14bc7ece8a7…0476cfcef110in 2 reports
- 31ce76931ca09d39…3bc72e6d647ein 2 reports
- b9820bf443c37557…e3a569a1b9e8in 2 reports
- 34270b07538b7357…8f234b602f93in 2 reports
- 09735640d6634b03…bc80f932126cin 2 reports
- 85bc0a4f67522d6a…5a2945ec5028in 2 reports
- 711c95fead2215e9…0d71ad5c5aa5in 2 reports
- bc65ed919988c8e4…45456601700ain 2 reports
- 148c0cde4f2ef807…0f4c519f47efin 2 reports
- 468121e7d6952799…937c4c5f92edin 2 reports
- c881f43c7fe94a6f…32fe56d8dd9cin 2 reports
Copy these 20 indicators · defanged
Thanks — we review every report.