Ransomware Group intelligence
Ransomhouse
ActiveTrack Ransomhouse with 233 published victims and 3 known leak locations in a single intelligence view.
BREACH HOUSE ALERTS
Want an alert every time a new ransomware post is published?
Choose the feeds and the countries you care about — we email you when they move.
Overview
Ransomhouse is tracked by Breach House as a ransomware group with 233 published victims.
United States is currently the most targeted country in this dataset.
3 known leak locations are currently associated with this group.
Leak Status Distribution
233
- Leaked 22 9.4%
- Pending 211 90.6%
- Deleted 0 0.0%
Top Countries
Interactive distribution based on the currently visible victims list.
Known Leak Locations (3)
| Label | Type | Availability | Links |
|---|---|---|---|
| Leak location 2 | Onion service | Down checked 2h ago | zohlm7ahjwegcedoz7lrdrti7bvpofymcayotp744qhx6gjmxbuo2yid.onion |
| Leak location 3 | Onion service | Down checked 2h ago | secxrosqawaefsio3biv2dmi2c5yunf3t7ilwf54czq3v4bi7w6mbfad.onion |
| Leak location 1 | Onion service | Down checked 2h ago | xw7au5pnwtl6lozbsudkmyd32n6gnqdngitjdppybudan3x3pjgpmpid.onion |
Top Activity Sectors (18)
- Communication / Marketing 57
- Manufacturing / Engineering 26
- Services 20
- IT 20
- Healthcare / Pharma 19
- Finance / Legal / Insurance 15
- Public Sector 14
- Not identified 13
- Construction / Real Estate 8
- Retail / E-commerce 6
- Agriculture / Food 6
- Transportation / Travel / Logistics 6
- Energy 6
- Education 6
- Hospitality / Food & Beverage / Tourism 3
- null 2
- Telecommunications 2
- NGOs / Associations 1
Typical Attacks (10)
▼MITRE ATT&CK does not currently catalogue Ransomhouse, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v19.2. Confidence: medium. Treat it as orientation, not attribution.
-
T1059.001 PowerShell Execution
What they do: ransomhouse uses PowerShell scripts to execute payload deployment and system modifications across compromised hosts.
What that means: Adversaries may abuse PowerShell commands and scripts for execution.
-
What they do: ransomhouse modifies registry run keys and startup folders to ensure recurring execution after reboots.
What that means: Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key.
-
T1685 Disable or Modify Tools Defense Impairment
What they do: ransomhouse disables antivirus tools and security software to prevent detection and mitigation responses.
What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
-
T1027.016 Junk Code Insertion Stealth
What they do: ransomhouse inserts junk code into legitimate binaries to evade static behavioral analysis and detection.
What that means: Adversaries may use junk code / dead code to obfuscate a malware’s functionality.
-
T1070.004 File Deletion Stealth
What they do: ransomhouse deletes Volume Shadow Copies and backup files to eliminate recovery options for encrypted systems.
What that means: Adversaries may delete files left behind by the actions of their intrusion activity.
-
T1003.001 LSASS Memory Credential Access
What they do: ransomhouse targets LSASS memory to extract credentials for persistence and privilege escalation across the network.
What that means: Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS).
-
T1049 System Network Connections Discovery Discovery
What they do: ransomhouse queries system network connections to identify additional hosts and services for lateral movement.
What that means: Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.
-
T1057 Process Discovery Discovery
What they do: ransomhouse runs process discovery commands to identify active services and processes for targeting or disabling.
What that means: Adversaries may attempt to get information about running processes on a system.
-
T1021.002 SMB/Windows Admin Shares Lateral Movement
What they do: ransomhouse exploits SMB/Windows Admin Shares to move laterally between networked machines within victim environments.
What that means: Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).
-
T1486 Data Encrypted for Impact Impact
What they do: ransomhouse encrypts critical data files and business documents using its ransomware payload to demand payment.
What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
Ransom Notes (3)
▼The note this group leaves on a compromised machine. Click a filename to read it.
White_Rabbit.txt
��--------------------------------------------------------------------------
Welcome to the RansomHouse
You are locked by
W H I T E R A B B I T
Knock, Knock. Follow the White Rabbit...
(\(\ Come, come now. Crying won't help.
(-.-)
(")(")
Dear The [snip] Management,
If you are reading this message, it means that:
- your network infrastructure has been compromised,
- critical data was leaked,
- files are encrypted
--------------------------------------------------------------------------
The best and only thing you can do is to contact us
to settle the matter before any losses occurs.
Onion Site:
http://zohlm7ahjwegcedoz7lrdrti7bvpofymcayotp744qhx6gjmxbuo2yid.onion/
Telegram Channel:
https://t.me/ransom_house
--------------------------------------------------------------------------
1. THE FOLLOWING IS STRICTLY FORBIDDEN
1.1 EDITING FILES ON HDD.
Renaming, copying or moving any files
could DAMAGE the cipher and
decryption will be impossible.
1.2 USING THIRD-PARTY SOFTWARE.
Trying to recover with any software
can also break the cipher and
file recovery will become a problem.
1.3 SHUTDOWN OR RESTART THE PC.
Boot and recovery errors can also damage the cipher.
Sorry about that, but doing so is entirely at your own risk.
--------------------------------------------------------------------------------------------------
2. EXPLANATION OF THE SITUATION
2.1 HOW DID THIS HAPPEN
The security of your IT perimeter has been compromised (it's not perfect at all).
We encrypted your workstations and servers to make the fact of the intrusion visible and to prevent you from hiding critical data leaks.
We spent a lot of time researching and finding out the most important directories of your business, your weak points.
We have already downloaded a huge amount of critical data and analyzed it. Now its fate is up to you, it will either be deleted or sold, or shared with the media.
2.2 VALUABLE DATA WE USUALLY STEAL:
- Databases, legal documents, personal information.
- Audit reports.
- Any financial documents (Statements, invoices, accounting, transfers etc.).
- Work files and corporate correspondence.
- Any backups.
- Confidential documents.
2.3 TO DO LIST (best practies)
- Contact us as soon as possible.
- Contact us only in our live chat, otherwise you can run into scammers.
- Purchase our decryption tool and decrypt your files. There is no other way to do this.
- Realize that dealing with us is the shortest way to success and secrecy.
- Give up the idea of using decryption help programs, otherwise you will destroy the system permanently.
- Avoid any third-party negotiators and recovery groups. They can become the source of leaks.
--------------------------------------------------------------------------------------------------
3. POSSIBLE DECISIONS
3.1 NOT MAKING THE DEAL
- After 4 days starting tomorrow your leaked data will be Disclosed or sold.
- We will also send the data to all interested supervisory organizations and the media.
- Decryption key will be deleted permanently and recovery will be impossible.
- Losses from the situation can be measured based on your annual budget.
3.2 MAKING THE WIN-WIN DEAL
- You will get the only working Decryption Tool and the how-to-use Manual.
- You will get our guarantees (with log provided) of non-recovarable deletion of all your leaked data.
- You will get our guarantees of secrecy and removal of all traces related to the deal in the Internet.
- You will get our security report on how to fix your security breaches.
--------------------------------------------------------------------------------------------------
4. EVIDENCE OF THE LEAKAGE
In our live chat
http://p2tn23lt5zpzzyo4bmnpwgbmxhnifggk5ioizmmaeuz4n2bcyv2q44yd.onion/?Url=[snip]
--------------------------------------------------------------------------------------------------
5. HOW TO CONTACT US
5.1 Download and install TOR Browser https://torproject.org
5.2 Go to our live-chat website at http://p2tn23lt5zpzzyo4bmnpwgbmxhnifggk5ioizmmaeuz4n2bcyv2q44yd.onion/?Url=[snip]
5.3 You can request ftp server access in our live chat to review leaked data samples.
5.4 In case TOR Browser is restricted in your area use VPN services.
5.5 All leaked Data samples will be Disclosed in 4 Days if you remain silent.
5.6 Your Decryption keys will be permanently destroyed at the moment the leaked Data is Disclosed.
--------------------------------------------------------------------------------------------------
6. RESPONSIBILITY
6.1 Breaking critical points of this offer will cause:
- Deletion of your decryption keys.
- Immediate sale or complete Disclosure of your leaked data.
- Notification of government supervision agencies, your competitors and clients.
--------------------------------------------------------------------------------------------------
Restore Your Files.txt
--------------------------------------------------------
Welcome to the RansomHouse
You are locked by
M A R I O ESXI
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣠⣴⡾⣻⣿⣿⣿⣿⣯⣍⠛⠻⢷⣦⣀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⣴⣿⠟⢁⣾⠟⠋⣁⣀⣤⡉⠻⣷⡀⠀⠙⢿⣷⣄⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⢀⡀⠀⠀⠀⠀⠀⠀⣰⣿⠏⠀⠀⢸⣿⠀⠼⢋⣉⣈⡳⢀⣿⠃⠀⠀⠀⠙⣿⣦⡀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⢰⡿⠿⣷⡀⠀⠀⠀⣼⣿⠃⠀⠀⣀⣤⡿⠟⠛⠋⠉⠉⠙⢛⣻⠶⣦⣄⡀⠀⠘⣿⣷⡀⠀⠀⠀
⢠⣾⠟⠳⣦⣄⢸⡇⠀⠈⣷⡀⠀⣼⣿⡏⢀⣤⡾⢋⣵⠿⠻⢿⠋⠉⠉⢻⠟⠛⠻⣦⣝⠻⣷⣄⠸⣿⣿⠀⠀⠀
⠘⣧⠀⠀⠀⠙⢿⣿⠀⠀⢸⣷⠀⣿⣿⣧⣾⣏⡴⠛⢡⠖⢛⣲⣅⠀⠀⣴⣋⡉⠳⡄⠈⠳⢬⣿⣿⣿⡿⠀⠀⠀
⠀⠘⠷⣤⣀⣀⣀⣽⡶⠛⠛⠛⢷⣿⣿⣿⣿⣏⠀⠀⡏⢰⡿⢿⣿⠀⠀⣿⠻⣿⠀⡷⠀⣠⣾⣿⡿⠛⠷⣦⠀⠀
⠀⠀⢀⣾⠟⠉⠙⣿⣤⣄⠀⢀⣾⠉⠀⢹⣿⣿⣷⠀⠹⡘⣷⠾⠛⠋⠉⠛⠻⢿⡴⢃⣄⣻⣿⣿⣷⠀⠀⢹⡇⠀
⠀⠀⢸⡇⠈⠉⠛⢦⣿⡏⠀⢸⣧⠀⠈⠻⣿⡿⢣⣾⣦⣽⠃⠀⠀⠀⠀⠀⠀⠀⣷⣾⣿⡇⠉⢿⡇⠀⢀⣼⠇⠀
⠀⠀⠘⣷⡠⣄⣀⣼⠇⠀⠀⠀⠻⣷⣤⣀⣸⡇⠀⠹⣿⣿⣦⣀⠀⠀⠀⠀⢀⣴⣿⣿⡟⠀⠀⢸⣷⣾⡿⠃⠀⠀
⠀⠀⠀⠈⠻⢦⣍⣀⣀⣀⡄⠀⣰⣿⡿⠿⢿⣇⠀⠀⠉⠛⠻⣿⣿⡷⠾⣿⣿⡿⠉⠁⠀⠀⢀⣾⠋⠁⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠈⠉⠉⠙⠿⢿⣿⣇⠀⠀⠈⢿⣧⣄⠀⠀⠀⢹⣷⣶⣶⣾⣿⡇⠀⠀⣀⣴⡿⣧⣄⡀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠙⢿⣷⡀⠀⠀⠙⢿⣿⣶⣤⡀⠻⢤⣀⡤⠞⢀⣴⣿⣿⠟⢷⡀⠙⠻⣦⣄⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⢻⣦⠀⢠⡟⠁⠙⢻⣿⠷⠶⣶⠶⠾⠛⠙⣿⠇⠀⠀⢻⡄⠀⠀⠙⢷⡀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣸⣿⡀⣿⠁⣤⣤⡄⢻⡶⠶⠛⠛⠛⠛⠛⣿⢠⣾⣷⣆⢻⡀⠀⠀⠈⣷
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣿⣿⣿⣿⢸⣿⣿⣿⡈⢿⡀⠀⠀⠀⠀⠀⡿⢸⣿⣿⣿⢸⡇⠀⠀⠀⡟
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⠉⠉⠉⠈⠉⠉⠉⠁⠈⠁⠀⠀⠀⠀⠈⠁⠈⠉⠉⠉⠀⠁⠀⠀⠈⠁
Dear [snip],
If you are reading this message, it means that:
- your network infrastructure has been compromised,
- critical data was leaked,
- files are encrypted
--------------------------------------------------------
The best and only thing you can do is to contact us
to settle the matter before any losses occurs.
Onion Site:
http://xw7au5pnwtl6lozbsudkmyd32n6gnqdngitjdppybudan3x3pjgpmpid.onion/
Telegram Channel:
https://t.me/ransom_house
--------------------------------------------------------
1. THE FOLLOWING IS STRICTLY FORBIDDEN
1.1 EDITING FILES ON HDD.
Renaming, copying or moving any files
could DAMAGE the cipher and
decryption will be impossible.
1.2 USING THIRD-PARTY SOFTWARE.
Trying to recover with any software
can also break the cipher and
file recovery will become a problem.
1.3 SHUTDOWN OR RESTART THE PC.
Boot and recovery errors can also damage the cipher.
Sorry about that, but doing so is entirely at your own risk.
--------------------------------------------------------
2. EXPLANATION OF THE SITUATION
2.1 HOW DID THIS HAPPEN
The security of your IT perimeter has been compromised (it's not perfect at all).
We encrypted your workstations and servers to make the fact of the intrusion visible and to prevent you from hiding critical data leaks.
We spent a lot of time researching and finding out the most important directories of your business, your weak points.
We have already downloaded a huge amount of critical data and analyzed it. Now its fate is up to you, it will either be deleted or sold, or shared with the media.
2.2 VALUABLE DATA WE USUALLY STEAL:
- Databases, legal documents, personal information.
- Audit reports.
- Any financial documents (Statements, invoices, accounting, transfers etc.).
- Work files and corporate correspondence.
- Any backups.
- Confidential documents.
2.3 TO DO LIST (best practies)
- Contact us as soon as possible.
- Contact us only in our live chat, otherwise you can run into scammers.
- Purchase our decryption tool and decrypt your files. There is no other way to do this.
- Realize that dealing with us is the shortest way to success and secrecy.
- Give up the idea of using decryption help programs, otherwise you will destroy the system permanently.
- Avoid any third-party negotiators and recovery groups. They can become the source of leaks.
--------------------------------------------------------
3. POSSIBLE DECISIONS
3.1 NOT MAKING THE DEAL
- After 6 days starting tomorrow your leaked data will be Disclosed or sold.
- We will also send the data to all interested supervisory organizations and the media.
- Decryption key will be deleted permanently and recovery will be impossible.
- Losses from the situation can be measured based on your annual budget.
3.2 MAKING THE WIN-WIN DEAL
- You will get the only working Decryption Tool and the how-to-use Manual.
- You will get our guarantees (with log provided) of non-recovarable deletion of all your leaked data.
- You will get our guarantees of secrecy and removal of all traces related to the deal in the Internet.
- You will get our security report on how to fix your security breaches.
--------------------------------------------------------
4. EVIDENCE OF THE LEAKAGE
In our live chat
http://secxrosqawaefsio3biv2dmi2c5yunf3t7ilwf54czq3v4bi7w6mbfad.onion/?Url=[snip]
--------------------------------------------------------
5. HOW TO CONTACT US
5.1 Download and install TOR Browser https://torproject.org
5.2 Go to our live-chat website at http://secxrosqawaefsio3biv2dmi2c5yunf3t7ilwf54czq3v4bi7w6mbfad.onion/?Url=[snip]
5.3 You can request ftp server access in our live chat to review leaked data samples.
5.4 In case TOR Browser is restricted in your area use VPN services.
5.5 All leaked Data samples will be Disclosed in 4 Days if you remain silent.
5.6 Your Decryption keys will be permanently destroyed at the moment the leaked Data is Disclosed.
--------------------------------------------------------
6. RESPONSIBILITY
6.1 Breaking critical points of this offer will cause:
- Deletion of your decryption keys.
- Immediate sale or complete Disclosure of your leaked data.
- Notification of government supervision agencies, your competitors and clients.
--------------------------------------------------------
How To Restore Your Files.txt
Welcome to the RansomHouse
You are locked by
M A R I O
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣠⣴⡾⣻⣿⣿⣿⣿⣯⣍⠛⠻⢷⣦⣀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⣴⣿⠟⢁⣾⠟⠋⣁⣀⣤⡉⠻⣷⡀⠀⠙⢿⣷⣄⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⢀⡀⠀⠀⠀⠀⠀⠀⣰⣿⠏⠀⠀⢸⣿⠀⠼⢋⣉⣈⡳⢀⣿⠃⠀⠀⠀⠙⣿⣦⡀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⢰⡿⠿⣷⡀⠀⠀⠀⣼⣿⠃⠀⠀⣀⣤⡿⠟⠛⠋⠉⠉⠙⢛⣻⠶⣦⣄⡀⠀⠘⣿⣷⡀⠀⠀⠀
⢠⣾⠟⠳⣦⣄⢸⡇⠀⠈⣷⡀⠀⣼⣿⡏⢀⣤⡾⢋⣵⠿⠻⢿⠋⠉⠉⢻⠟⠛⠻⣦⣝⠻⣷⣄⠸⣿⣿⠀⠀⠀
⠘⣧⠀⠀⠀⠙⢿⣿⠀⠀⢸⣷⠀⣿⣿⣧⣾⣏⡴⠛⢡⠖⢛⣲⣅⠀⠀⣴⣋⡉⠳⡄⠈⠳⢬⣿⣿⣿⡿⠀⠀⠀
⠀⠘⠷⣤⣀⣀⣀⣽⡶⠛⠛⠛⢷⣿⣿⣿⣿⣏⠀⠀⡏⢰⡿⢿⣿⠀⠀⣿⠻⣿⠀⡷⠀⣠⣾⣿⡿⠛⠷⣦⠀⠀
⠀⠀⢀⣾⠟⠉⠙⣿⣤⣄⠀⢀⣾⠉⠀⢹⣿⣿⣷⠀⠹⡘⣷⠾⠛⠋⠉⠛⠻⢿⡴⢃⣄⣻⣿⣿⣷⠀⠀⢹⡇⠀
⠀⠀⢸⡇⠈⠉⠛⢦⣿⡏⠀⢸⣧⠀⠈⠻⣿⡿⢣⣾⣦⣽⠃⠀⠀⠀⠀⠀⠀⠀⣷⣾⣿⡇⠉⢿⡇⠀⢀⣼⠇⠀
⠀⠀⠘⣷⡠⣄⣀⣼⠇⠀⠀⠀⠻⣷⣤⣀⣸⡇⠀⠹⣿⣿⣦⣀⠀⠀⠀⠀⢀⣴⣿⣿⡟⠀⠀⢸⣷⣾⡿⠃⠀⠀
⠀⠀⠀⠈⠻⢦⣍⣀⣀⣀⡄⠀⣰⣿⡿⠿⢿⣇⠀⠀⠉⠛⠻⣿⣿⡷⠾⣿⣿⡿⠉⠁⠀⠀⢀⣾⠋⠁⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠈⠉⠉⠙⠿⢿⣿⣇⠀⠀⠈⢿⣧⣄⠀⠀⠀⢹⣷⣶⣶⣾⣿⡇⠀⠀⣀⣴⡿⣧⣄⡀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠙⢿⣷⡀⠀⠀⠙⢿⣿⣶⣤⡀⠻⢤⣀⡤⠞⢀⣴⣿⣿⠟⢷⡀⠙⠻⣦⣄⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⢻⣦⠀⢠⡟⠁⠙⢻⣿⠷⠶⣶⠶⠾⠛⠙⣿⠇⠀⠀⢻⡄⠀⠀⠙⢷⡀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣸⣿⡀⣿⠁⣤⣤⡄⢻⡶⠶⠛⠛⠛⠛⠛⣿⢠⣾⣷⣆⢻⡀⠀⠀⠈⣷
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣿⣿⣿⣿⢸⣿⣿⣿⡈⢿⡀⠀⠀⠀⠀⠀⡿⢸⣿⣿⣿⢸⡇⠀⠀⠀⡟
Dear management,
If you are reading this message, it means that:
- your network infrastructure has been compromised,
- critical data was stolen,
- files are encrypted.
The best and only thing you can do is to contact us
to settle the matter before any losses occurs.
Check out our website:http://zohlm7ahjwegcedoz7lrdrti7bvpofymcayotp744qhx6gjmxbuo2yid.onion/
Telegram Channel: https://t.me/RHouseNews
-------------------------------------
1. THE FOLLOWING IS STRICTLY FORBIDDEN
1.1 EDITING FILES ON HDD.
Renaming, copying or moving any files
could DAMAGE the cipher and
decryption will be impossible.
1.2 USING THIRD-PARTY SOFTWARE.
Trying to recover with any software
can also break the cipher and
file recovery will become a problem.
1.3 SHUTDOWN OR RESTART THE PC.
Boot and recovery errors can also damage the cipher.
Sorry about that, but doing so is entirely at your own risk.
-------------------------------------
2. EXPLANATION OF THE SITUATION
2.1 HOW DID THIS HAPPEN
The security of your IT perimeter has been compromised (it's not perfect at all).
We encrypted your workstations and servers to make the fact of the intrusion visible and to prevent you from hiding critical data leaks.
We spent a lot of time researching and finding out the most important directories of your business, your weak points.
We have already downloaded a huge amount of critical data and analyzed it. Now its fate is up to you, it will either be deleted or sold, or shared with the media.
2.2 VALUABLE DATA WE USUALLY STEAL:
- Databases, legal documents, personal information.
- Audit reports.
- Any financial documents (Statements, invoices, accounting, transfers,e-mails, etc.).
- Work files and corporate correspondence.
- Any backups.
- Confidential documents.
2.3 TO DO LIST (best practies)
- Contact us as soon as possible.
- Contact us only in our live chat, otherwise you can run into scammers.
- Purchase our decryption tool and decrypt your files. There is no other way to do this.
- Realize that dealing with us is the shortest way to success and secrecy.
- Give up the idea of using decryption help programs, otherwise you will destroy the system permanently.
- Avoid any third-party negotiators and recovery groups. They can become the source of leaks.
-------------------------------------
3. POSSIBLE DECISIONS
3.1 NOT MAKING THE DEAL
- After 5 days starting tomorrow your leaked data will be Disclosed or sold.
- We will also send the data to all interested supervisory organizations and the media.
- Decryption key will be deleted permanently and recovery will be impossible.
- Losses from the situation can be measured based on your annual budget.
3.2 MAKING THE WIN-WIN DEAL
- You will get the only working Decryption Tool and the how-to-use Manual.
- You will get our guarantees (with log provided) of non-recovarable deletion of all your leaked data.
- You will get our guarantees of secrecy and removal of all traces related to the deal in the Internet.
- You will get our security report on how to fix your security breaches.
Another important fact to note here: after the deal is made, it would take only 4-6 hours to restore your infrastructure.
-------------------------------------
4. EVIDENCE OF THE LEAKAGE
In our live chat
http://q67l6d24zkprmodua6e5nta4rzn3hlltjonmmf33pp7s7tu3euztejyd.onion/?Url=[snip]
-------------------------------------
5. HOW TO CONTACT US
5.1 Download and install TOR Browser https://torproject.org
5.2 Go to our live-chat website at http://q67l6d24zkprmodua6e5nta4rzn3hlltjonmmf33pp7s7tu3euztejyd.onion/?Url=[snip]
5.3 You can request ftp server access in our live chat to review leaked data samples.
5.4 In case TOR Browser is restricted in your area use VPN services.
5.5 All leaked Data samples will be Disclosed in 5 Days if you remain silent.
5.6 Your Decryption keys will be permanently destroyed at the moment the leaked Data is Disclosed.
-------------------------------------
6. RESPONSIBILITY
6.1 Breaking critical points of this offer will cause:
- Deletion of your decryption keys.
- Immediate sale or complete Disclosure of your leaked data.
- Notification of government supervision agencies, your competitors and clients.
Ransom-note text from RansomLook, licensed CC BY 4.0.
Victims (233)
Search, filter and paginate the victim timeline for Ransomhouse. Showing 201–233 of 233.
| Type | Target | Discovered | Country | Business Category | Intel Link | Leak status |
|---|---|---|---|---|---|---|
| Ransomware | St. Kitts & Nevis id5698 View details | Saint Kitts and Nevis | Public Sector | pending | ||
|
Saint Kitts and Nevis, officially Federation of Saint Kitts and Nevis, also called Saint Christopher and Nevis, state composed of two islands of the Lesser Antilles in the eastern Caribbean Sea. Their combined area is 104 square miles (269 square km). The capital is Basseterre on the island of Saint Kitts. |
||||||
| Ransomware | Delaware Life Insurance Company id5689 View details | United States | Finance / Legal / Insurance | pending | ||
|
Founded in 2013, Delaware Life Insurance Company is a subsidiary of Group 1001 Insurance Holdings,LLC (Group 1001) a dynamic network of businesses making insurance more useful, logical, and accessible for everyone. As of June 30, 2022, the company had assets of $41.8 billion and liabilities of $39.7 billion (does not include Delaware Life Insurance Company of New York) with more than 320,000 active annuity and life insurance policies. |
||||||
| Ransomware | Audio Video id5558 View details | Communication / Marketing | — | pending | ||
|
Established in 1946 by WWII Veteran Milton A. Klarsfeld, Audio-Video Corporation was initially named The Albany Television Headquarters and was located on Hudson Avenue in Albany, NY. In 1954 the company changed its name to Audio-Video Corporation to better identify with current technology and services. Audio-Video Corporation headquarters is located in Albany, NY with a full service branch office in Syracuse, NY. Additionally, there are three satellite offices spread across NY and New England. Locations include Syracuse NY, Rochester NY, and Burlington VT. |
||||||
| Ransomware | Audio Video id5566 View details | Communication / Marketing | — | pending | ||
|
Established in 1946 by WWII Veteran Milton A. Klarsfeld, Audio-Video Corporation was initially named The Albany Television Headquarters and was located on Hudson Avenue in Albany, NY. In 1954 the company changed its name to Audio-Video Corporation to better identify with current technology and services. Audio-Video Corporation headquarters is located in Albany, NY with a full service branch office in Syracuse, NY. Additionally, there are three satellite offices spread across NY and New England. Locations include Syracuse NY, Rochester NY, and Burlington VT. |
||||||
| Ransomware | E&S Heating & Ventilation Ltd id5557 View details | United Kingdom | Manufacturing / Engineering | — | pending | |
|
E&S Heating & Ventilation Ltd has been at the forefront of ductwork manufacturing technology and investment since 1972. We offer all forms of ductwork manufacture, galvanised, Flameshield fire rated and stainless steel, associated equipment selection along with procurement, installation, insulation, testing and commissioning for air handling systems. |
||||||
| Ransomware | AESCULAPIUS Farmaceutici id5516 View details | Italy | Agriculture / Food | — | pending | |
|
The Research and Development Division is the heart of the company, which invests significant resources in innovation to develop new pharmaceutical products and new formulations with high technological content. |
||||||
| Ransomware | Bond It id5514 View details | United Kingdom | Communication / Marketing | — | pending | |
|
For almost two decades, Bond It has been a manufacturer of high performance, high quality building chemicals such as sealants, adhesives, grouts, cleaners, expanding foams, fillers, decorating sundries, landscaping products and other similar products. |
||||||
| Ransomware | Hospital Service SpA id5439 View details | Italy | Healthcare / Pharma | — | pending | |
|
HS was founded in 1980 with the objective to promote and distribute throughout Italy new methods of minimally invasive interventional diagnostic technologies, introducing on the National market a new generation of echo-guided biopsy products. |
||||||
| Ransomware | Jeffries Morris id5394 View details | Services | — | pending | ||
|
Jeffries Morris, Inc. provides acquisition, advisory and asset management services for real estate companies with investments in Metropolitan New York. |
||||||
| Ransomware | The DGCX id5381 View details | United Arab Emirates | Other | — | pending | |
|
Dubai has historically been an international hub for the physical trade of not only gold, but also many other commodities and so the establishment of the Dubai Gold & Commodities Exchange (DGCX) was the next logical step for the region and the local economy. DGCX commenced trading in November 2005 as the regions first commodity derivatives exchange and has become today, the leading derivatives exchange in the Middle East |
||||||
| Ransomware | Holovis id5246 View details | Communication / Marketing | — | pending | ||
|
Holovis design and install world-class experiential solutions for global themed entertainment, visitor attractions and enterprise clients. |
||||||
| Ransomware | Trans Maldivian Airways id5239 View details | Maldives | Transportation / Travel / Logistics | — | pending | |
|
Trans Maldivian Airways is your getaway to the stunning Maldives. With the world’s largest seaplane fleet, Trans Maldivian Airways takes you from Velana International Airport in Malé to your island holiday destination. Life is about the journey, and this will likely be the most scenic one in your life. Trans Maldivian Airways currently offers transfer services to more than 80 Maldives resorts, flying over 1,000,000 passengers per year to their holiday hideaways. |
||||||
| Ransomware | IMI Hydronic Engineering id5229 View details | Manufacturing / Engineering | — | pending | ||
|
IMI plc is a global engineering group that focuses on precision fluid engineering. IMI plc incorporates three divisions, each working to make its vision come to life – IMI Hydronic, Norgren and IMI Critical. |
||||||
| Ransomware | Republic of Vanuatu id5093 View details | Vanuatu | Healthcare / Pharma | — | pending | |
|
We are a leading multinational health group committed to keeping communities healthy through our own Comprehensive Health Model, which is based on prevention, identification and management of health risks, and control and management of the disease and the dependency. |
||||||
| Ransomware | Strem Chemicals id5082 View details | Manufacturing / Engineering | — | pending | ||
|
Strem established in 1964, is a company that manufactures and markets specialty chemicals of high purity. Strem was acquired by Ascensus Specialties in 2021. Its clients include academic, industrial and government research and development laboratories as well as commercial scale businesses in the pharmaceutical, microelectronic and chemical / petrochemical industries. Strem also provides custom synthesis (including high pressure synthesis) and cGMP manufacturing services. |
||||||
| Ransomware | Keralty id4912 View details | Healthcare / Pharma | — | pending | ||
|
We are a leading multinational health group committed to keeping communities healthy through our own Comprehensive Health Model, which is based on prevention, identification and management of health risks, and control and management of the disease and the dependency. |
||||||
| Ransomware | Advanced Micro Devices, Inc id4741 View details | Services | — | pending | ||
|
No additional victim description available. |
||||||
| Ransomware | Fairfax - Crum & Forster id4740 View details | Other | — | pending | ||
|
No additional victim description available. |
||||||
| Ransomware | Ipca Laboratories id4739 View details | Other | — | pending | ||
|
No additional victim description available. |
||||||
| Ransomware | Carmen Copper Corporation id4738 View details | Services | — | pending | ||
|
No additional victim description available. |
||||||
| Ransomware | ROFA INDUSTRIAL AUTOMATION id4737 View details | Manufacturing / Engineering | — | pending | ||
|
No additional victim description available. |
||||||
| Ransomware | ADATA Technology id4736 View details | IT | — | pending | ||
|
No additional victim description available. |
||||||
| Ransomware | Severn Glocon Group id4735 View details | Services | — | pending | ||
|
No additional victim description available. |
||||||
| Ransomware | SMB Solutions id4734 View details | Services | — | pending | ||
|
No additional victim description available. |
||||||
| Ransomware | BRYCON Construction id4733 View details | Construction / Real Estate | — | pending | ||
|
No additional victim description available. |
||||||
| Ransomware | 8 Italy Districts id3941 View details | Other | — | pending | ||
|
No additional victim description available. |
||||||
| Ransomware | Summit Care id3766 View details | Other | — | pending | ||
|
No additional victim description available. |
||||||
| Ransomware | SHOPRITE HOLDINGS LTD id3632 View details | Retail / E-commerce | — | pending | ||
|
No additional victim description available. |
||||||
| Ransomware | Saskatchewan Liquor and Gaming Authority id3399 View details | Public Sector | — | pending | ||
|
No additional victim description available. |
||||||
| Ransomware | Jefferson Credit Union id3398 View details | Finance / Legal / Insurance | — | pending | ||
|
No additional victim description available. |
||||||
| Ransomware | Dellner Couplers AB id3397 View details | Other | — | pending | ||
|
No additional victim description available. |
||||||
| Ransomware | AHS Aviation Handling Services GmbH id3396 View details | Transportation / Travel / Logistics | — | pending | ||
|
No additional victim description available. |
||||||
| Ransomware | AMD (semiconductor giant) id644 View details | United States | Other | — | pending | |
|
No additional victim description available. |
||||||