Ransomhouse

RansomHouse, active since 2021, is a malware group that identifies itself as a "professional mediators community" and targets organizations showing negligence towards their customers' data privacy and security. The group has claimed significant victims such as chipmaker AMD and Africa's largest retailer, Shoprite. RansomHouse is known for using various ransomware strains available on dark markets, rather than having its own signature ransomware. Interestingly, the group often purchases already compromised data or collaborates with data leak sites to extort victims. Recent advisories from CISA and FBI have identified Fox Kitten, an Iranian group, as providing initial access to compromised networks for ransomware strains like ALPHV (or BlackCat), RansomHouse, and NoEscape. In a more recent development, Fox Kitten has been found directly collaborating with ransomware gangs, including NoEscape, RansomHouse, and ALPHV/BlackCat. This collaboration involves sharing a percentage of any collected ransom payments. The partnership between these groups represents a concerning evolution in the threat landscape, as it points to a higher degree of cooperation among different cybercriminal entities. The analysis conducted by VMware Carbon Black’s TAU and MDR-POC teams has revealed intriguing similarities between RansomHouse and another ransomware group, 8Base. Both groups use similar ransom notes and a variety of ransomware strains, including a variant known as Phobos. Further, 8Base's verbal style, based on its leak site and public accounts, is quite akin to RansomHouse. These findings have raised questions about whether 8Base operates similarly to RansomHouse by using different ransomware and if 8Base might be an offshoot of RansomHouse.