RansomHouse Mario encryptor upgrade
Malware Activity
Summary
Hide ▲
Show ▼
The RansomHouse ransomware operation has upgraded its Mario encryptor to a multi-layered design, making decryption and static analysis harder. The new variant uses a two-stage transformation with a 32-byte primary key and an 8-byte secondary key. It still targets VM files, appends the .emario extension, and drops How To Restore Your Files.txt on impacted directories. The changes improve encryption strength and reliability while giving operators more leverage during post-encryption negotiations.
Related Happenings
Vect ransomware flawed ChaCha20 implementation destroys large files
Technical Analysis
H score4
First: 29.04.2026 13:45
Last: 29.04.2026 13:45
Sources 1
About this happening:
Vect 2.0 ransomware was shown to use raw ChaCha20-IETF (RFC 8439) without authentication, causing files above 128 KB to be permanently destroyed across Windows, Linu...
Vect ransomware flawed ChaCha20 implementation destroys large files
Technical AnalysisAbout this happening: Vect 2.0 ransomware was shown to use raw ChaCha20-IETF (RFC 8439) without authentication, causing files above 128 KB to be permanently destroyed across Windows, Linu...
VECT 2.0 ransomware-branded file destruction malware
Malware Activity
H score4
First: 28.04.2026 17:01
Last: 28.04.2026 17:01
Sources 1
About this happening:
The VECT 2.0 malware now behaves like a wiper rather than recoverable ransomware, permanently destroying large files and raising the stakes for victims. The destructive fl...
VECT 2.0 ransomware-branded file destruction malware
Malware ActivityAbout this happening: The VECT 2.0 malware now behaves like a wiper rather than recoverable ransomware, permanently destroying large files and raising the stakes for victims. The destructive fl...
TeamPCP and Vect partner to turn supply-chain compromises into ransomware follow-on campaigns
Threat Actor Meta
H score11
First: 31.03.2026 15:15
Last: 31.03.2026 15:15
Sources 1
About this happening:
TeamPCP and Vect ransomware group are linking supply-chain compromises to follow-on ransomware campaigns, broadening extortion risk for affected organizations. The shi...
TeamPCP and Vect partner to turn supply-chain compromises into ransomware follow-on campaigns
Threat Actor MetaAbout this happening: TeamPCP and Vect ransomware group are linking supply-chain compromises to follow-on ransomware campaigns, broadening extortion risk for affected organizations. The shi...
Vect ransomware activity with cross-platform encryption and double extortion
Malware Activity
H score38
First: 03.02.2026 16:00
Last: 03.02.2026 16:00
Sources 1
About this happening:
Security researchers say Vect is a new ransomware-as-a-service (RaaS) operation that has already claimed victims in Brazil and South Africa. Its malware targets ...
Vect ransomware activity with cross-platform encryption and double extortion
Malware ActivityAbout this happening: Security researchers say Vect is a new ransomware-as-a-service (RaaS) operation that has already claimed victims in Brazil and South Africa. Its malware targets ...
CyberVolk VolkLocker RaaS debut targeting Linux/VMware ESXi and Windows
Malware Activity
H score15
First: 13.12.2025 17:11
Last: 13.12.2025 17:11
Sources 1
About this happening:
CyberVolk expanded its VolkLocker ransomware operation in August 2025, putting Linux/VMware ESXi and Windows environments at risk. The malware’s Golang timer...
CyberVolk VolkLocker RaaS debut targeting Linux/VMware ESXi and Windows
Malware ActivityAbout this happening: CyberVolk expanded its VolkLocker ransomware operation in August 2025, putting Linux/VMware ESXi and Windows environments at risk. The malware’s Golang timer...
Timeline
-
20.12.2025 17:23 2 articles · 6mo ago
RansomHouse Mario encryptor upgrade analysis
Technical Analysis UpdateRansomHouse’s Mario ransomware encryptor was upgraded from a single-pass file data transformation to a two-stage, multi-layered design that uses a 32-byte primary key and an 8-byte secondary key, dynamic chunk sizing at an 8GB threshold, intermittent encryption, and more complex memory and buffer organization. The variant still targets VM files, renames encrypted files with the .emario extension, and drops How To Restore Your Files.txt, while Unit 42 says the changes make static analysis, reverse engineering, and decryption harder and increase leverage in post-encryption negotiations.
Show sources
- RansomHouse upgrades encryption with multi-layered data processing — www.bleepingcomputer.com — 20.12.2025 17:23
- RansomHouse upgrades encryption with multi-layered data processing — www.bleepingcomputer.com — 20.12.2025 17:23