Ransomware group profile · #30 by claimed victims

Ransomhouse ransomware

RansomHouse is a double-extortion RaaS operation active since late 2021, attributed to the threat actor "Jolly Scorpius," targeting over 120 organizations across healthcare, finance, transportation, and government, recently upgrading to a multi-layered dual-key encryption architecture.

Active First seen Jun 2021

209Victims claimed on leak sites

4Victims in the last 30 days

14Victims in the last 90 days

48Countries hit

186Leak-site URLs tracked, 14 online

15 Sep 2026Latest claim recorded

Victimology

Who Ransomhouse claims to have breached, from 209 leak-site posts recorded by VULONE.

Claims per month last 12 months

Top sectors

Manufacturing40

Professional Services35

Healthcare26

Technology21

Government & Defense21

Financial Services16

Retail & E-Commerce11

Energy & Utilities10

Top countries

United States43

China10

United Kingdom9

Spain8

Japan8

Italy8

India5

Brazil5

Latest claimed victims 12 most recent

Victim	Sector	Country	Claimed
[DISCLOSED] California School Employees Association	—	—	15 Sep 2026
California School Employees Association	—	—	10 Sep 2026
California School Employees Association csea.com	Education	US	10 Sep 2026
REXT Holdings Co., Ltd. rext.jp	Other	JP	1 Sep 2026
Alya Construtora alyaconstrutora.com	Manufacturing	BR	7 Aug 2026
TECHVENTURES BANK S.A. techventures.bank	Financial Services	PA	6 Aug 2026
City of Beacon beaconny.gov	Government & Defense	US	6 Aug 2026
lya Construtora mcminnvilleoregon.gov	Manufacturing	US	6 Aug 2026
City of McMinnville OR mcminnvilleoregon.gov	Government & Defense	US	6 Aug 2026
PCL Holding pclholding.com	Professional Services	CA	3 Aug 2026
Nichirei nichirei.co.jp	Agriculture and Food Production	JP	21 Jul 2026
Megawork megawork.com.br	Professional Services	BR	16 Jul 2026

All 209 Ransomhouse victims, searchable

Full victim list with claim posts, domains, timing and exports, plus the negotiation chats and leak-site screenshots VULONE archives for this crew.

Start free Sign in

Tactics, techniques and procedures

ATT&CK technique mapping for Ransomhouse is in progress. Victimology, infrastructure status and leak-site tracking are live above.

Indicators, detections and the full playbook

Hashes, C2 addresses, onion services, Sigma and YARA detections per technique, and the negotiation transcripts are available to signed-in analysts.

See full IOCs

Frequently asked

Is Ransomhouse ransomware still active?

Ransomhouse is tracked as active. The most recent leak-site claim VULONE recorded is dated 15 September 2026. 4 victims were claimed in the last 30 days.

How many victims has Ransomhouse claimed?

VULONE has recorded 209 leak-site victim claims attributed to Ransomhouse since June 2021, across 48 countries and 13 sectors.

Which industries does Ransomhouse target?

The sectors most often named on the Ransomhouse leak site are Manufacturing, Professional Services, Healthcare.

Which countries are most affected by Ransomhouse?

Most Ransomhouse victims recorded by VULONE are located in United States, China, United Kingdom.

Where does VULONE get Ransomhouse victim data?

Claims are collected continuously from the group's own leak sites and cross-checked with ransomware.live and RansomLook. A claim is the group's assertion, not a confirmed breach.

Other ransomware groups

Victim claims are collected from leak sites and enrichment partners (ransomware.live, RansomLook) and represent the group's own assertions, not confirmed breaches. Profile last updated 16 September 2026. Questions or corrections: [email protected].