Threat Group Profile
ransomhouse
Dormant / historical
Victim claims
11
First seen
Apr 2026
Last activity
12 Jul 2026
Tracked since
Jun 2021
Group overview
RansomHouse is a double-extortion RaaS operation active since late 2021, attributed to the threat actor "Jolly Scorpius," targeting over 120 organizations across healthcare, finance, transportation, and government, recently upgrading to a multi-layered dual-key encryption architecture.
Preferred targets
Manufacturing · 2
Technology · 2
Construction · 1
Public Sector · 1
Agriculture and Food Production · 1
Transportation/Logistics · 1
Most targeted countries
US · 4
IT · 1
AR · 1
HK · 1
IN · 1
ID · 1