Overview
RansomHouse is a data-extortion group that first appeared in the first quarter of 2022. Its defining activity is publishing data it says it stole from organizations on its own Tor-hosted website.
It is not clear whether RansomHouse breaks into victim networks itself or buys already-breached data from other criminals and then extorts the victims. Open reporting has not established the group’s primary motivations or its specific intrusion methods.
RansomHouse should not be confused with RansomHub. RansomHub was a separate ransomware-as-a-service operation, also known as Cyclops and Knight, that was active from February 2024 until it shut down in early 2025. The two names are similar, but the groups, timelines and tradecraft are distinct.
Operating Model
RansomHouse’s model centers on extortion through data exposure, not on a recruited affiliate network. Its activity falls into three core functions:
- Data acquisition: obtaining sensitive data from victim organizations, either through its own intrusions or by purchasing breached data from others.
- Extortion: contacting victims and demanding payment to keep the remaining data private.
- Data publication: posting samples, and eventually full datasets, on its Tor leak site when victims don’t pay.
An illustrative attack sequence, assuming the group carries out the intrusion itself, runs as follows:
- Operators select a high-profile organization as the target.
- They research its security posture and look for viable entry points.
- They breach the network and exfiltrate valuable data.
- They post samples of the stolen data on the Tor site and demand a ransom to withhold the rest.
- They rely on encrypted channels, Tor hosting and cryptocurrency payments to make tracing them harder for law enforcement.
This sequence is a representative scenario, not a documented case.
Targeting and Reach
RansomHouse’s activity covers 14 countries and 15 industry categories. That footprint is far narrower than the large ransomware-as-a-service operations, which fits a single group picking its own victims rather than a network of affiliates.
Unlike many groups, its targeting is weighted toward Asia-Pacific, which makes up six of the 14 countries.
Asia-Pacific accounts for the largest share, with six countries: China, Hong Kong, Indonesia, Japan, Taiwan and Thailand. The Americas and Europe follow with three countries each. In the Americas, these are the United States, Brazil and Peru; in Europe, France, Romania and the United Kingdom.
Africa accounts for the remaining two: Namibia and South Africa.
The 15 industry categories are:
- automotive
- banking, financial services and insurance (BFSI)
- construction
- consumer goods
- energy and utilities
- food and beverages
- government and law enforcement
- healthcare
- IT and IT-enabled services
- metals, minerals and mining
- pharmaceuticals and biotechnology
- professional services
- transportation and logistics
- multi-sector organizations
- other organizations
The victims include critical services such as healthcare, energy and government. The deciding factor appears to be the value of the data that can be obtained, not the sector.
Malware and Tooling
The source material does not attribute a named malware family to RansomHouse. Its one confirmed piece of infrastructure is a Tor-hosted leak site.
Tor leak site
Tor routes traffic through multiple relays under layers of encryption, which makes the people running a site hard to locate. RansomHouse uses it for two things: hosting the site where stolen data is shown and published, and limiting what investigators can learn about the operators.
Encryption capability
The group’s ATT&CK mapping includes Data Encrypted for Impact (T1486). That suggests encryption has featured in at least some RansomHouse incidents, alongside pure data theft. No specific encryptor is named in the source, so this capability should be treated as unconfirmed until it is tied to a known tool.
MITRE ATT&CK Mapping
- Initial Access (TA0001) – Exploit Public-Facing Application (T1190): RansomHouse exploits weaknesses in internet-facing systems to gain entry to victim networks.
- Defense Evasion (TA0005) – Valid Accounts (T1078): RansomHouse uses legitimate credentials to blend in with normal user activity.
- Defense Evasion (TA0005) – Domain Accounts (T1078.002): RansomHouse abuses Active Directory accounts, sometimes highly privileged ones, to operate with less scrutiny.
- Lateral Movement (TA0008) – Remote Services (T1021): RansomHouse logs into remote services with stolen credentials to spread through the network.
- Lateral Movement (TA0008) – Remote Desktop Protocol (T1021.001): RansomHouse uses RDP sessions to reach additional hosts.
- Collection (TA0009) – Archive Collected Data (T1560): RansomHouse compresses or encrypts stolen data before moving it out of the network.
- Exfiltration (TA0010) – Exfiltration Over Web Service (T1567): RansomHouse sends data out through legitimate web services that are already common in normal traffic.
- Exfiltration (TA0010) – Exfiltration to Cloud Storage (T1567.002): RansomHouse moves stolen data to cloud storage services.
- Command and Control (TA0011) – Application Layer Protocol (T1071): RansomHouse hides its command traffic inside ordinary application protocols.
- Impact (TA0040) – Data Encrypted for Impact (T1486): RansomHouse encrypts data on victim systems to increase the pressure to pay.
Conclusion
RansomHouse shows that extortion doesn’t require a large affiliate network. Stolen data and a credible threat to publish it can be enough. Active since early 2022, the group has reached 14 countries and 15 industry categories, with a notable concentration in Asia-Pacific.
The biggest open question is whether RansomHouse runs its own intrusions or buys access and data from others. Either way, its ATT&CK profile points to clear defensive priorities:
- patch internet-facing systems promptly
- protect privileged and domain accounts
- restrict and monitor RDP
- watch for large outbound transfers to web and cloud storage services
Cyble’s threat intelligence monitors underground forums, leak sites, and dark web chatter, warning you when your organization or suppliers are being targeted. Book a free demo to get ahead of RansomHouse and the next extortion group aimed at your industry.
Frequently Asked Questions (FAQs) about RansomHouse
Who is RansomHouse?
A data-extortion group that publishes data it claims to have stolen from organizations on its Tor-hosted website.
How long has it been active?
Since the first quarter of 2022.
Is RansomHouse the same as RansomHub?
No. RansomHub was a separate ransomware-as-a-service operation, active from February 2024 until it shut down in early 2025.
Does it carry out its own intrusions?
That is unconfirmed. It may breach victims directly, or it may buy breached data and then extort the victims.
What extortion model does it use?
It pressures victims to pay so that stolen data stays off its leak site. Its ATT&CK mapping also lists data encryption, which suggests encryption has been part of some incidents.
What tools are linked to it?
No named malware family is attributed to it in the source. It relies on the Tor network to host its leak site.
How widespread is it?
Its activity covers 14 countries and 15 industry categories, with six of those countries in Asia-Pacific.
Disclaimer: This profile is compiled from open-source reporting and Cyble’s threat intelligence research as of the date of publication. Details about RansomHouse, including its methods, infrastructure and victims, may change as new information emerges. Country and industry figures and MITRE ATT&CK mappings reflect publicly reported activity and may not be complete. This content is provided for informational purposes only. It should not be taken as definitive attribution or as a substitute for professional security advice.
