File · RansomHouse · Unknown · misp-galaxy · refreshed 2026-10-06 · on the wire
RansomHouse
sigil · no ATT&CK coverage stated
Last 30 days
last seen 15 d ago- seen against
- Brazil · Indonesia · Peru
- sectors
- Energy & Utilities · Healthcare · Other
What changed
ledger · newest first- —15 d agoresurfacedback on the wire after 15 quiet days
- —24 d agovictimsvictim count 11 → 13 (+2)
- —1 mo agovictimsvictim count 10 → 11 (+1)
Analyst brief
misp-galaxyThis group started operating during the first quarter of 2022. They published samples of alleged stolen data from companies on their site on Tor. It is unclear if they conducted the attacks themselves, or if they bought leaked databases from third parties.
Observed targets (as stated by the sources)
6 countries · 7 sectorsassessed originnot stated by sourcesobserved targets · 6
countries · 6
- Indonesia
- United States
- Japan
- Peru
- Brazil
- Panama
sectors · 7
- Private sector
- Energy & Utilities
- Government & Defense
- Other
- Healthcare
- Education
- Financial Services
also stated: Namibia
as stated by MISP galaxy / ransomware.live — not inferred
On the wire
1 dispatch · newest firstTake it with you
keyless · no signupReferences
1 sourceTrack RansomHouse on the wire.
This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.