‘MrAgent’ ransomware tool from RansomHouse Group targets ESXi servers

‘MrAgent’ ransomware tool from RansomHouse Group targets ESXi servers

A new ransomware tool called “MrAgent” operates as a binary designed to run primarily on VMware ESXi hypervisors with the sole purpose of automating and tracking the deployment of ransomware across large environments with multiple hypervisors. In a Feb. 14 blog post, Trellix researchers identified the gang responsible, the RansomHouse Group, as a ransomware-as-a-service operation … Read more

RansomHouse gang automates VMware ESXi attacks with new MrAgent tool

RansomHouse gang automates VMware ESXi attacks with new MrAgent tool

The RansomHouse ransomware operation has created a new tool named ‘MrAgent’ that automates the deployment of its data encrypter across multiple VMware ESXi hypervisors. RansomHouse is a ransomware-as-a-service (RaaS) operation that emerged in December 2021 and is using double extortion tactics. In May 2022, the operation set up a dedicated victim extortion page on the dark web. … Read more