RansomHouse, a ransomware-as-a-service (RaaS) operation, has enhanced its encryptor from a single-phase linear technique to a more complex, multi-layered method, as detailed by Palo Alto Networks Unit 42. This upgrade provides stronger encryption, faster speeds, and improved reliability in modern environments, boosting threat actors’ leverage during negotiations. Initially launched in December 2021 as a data extortion group, RansomHouse later integrated encryptors into its attacks and developed the MrAgent tool to lock multiple VMware ESXi hypervisors simultaneously. The latest encryptor variant, dubbed ‘Mario,’ employs a two-stage transformation with a 32-byte primary key and an 8-byte secondary key, increasing encryption entropy and complicating partial data recovery. It also introduces dynamic chunk sizing at an 8GB threshold with intermittent encryption, complicating static analysis due to non-linearity and complex math determining processing order. Additionally, ‘Mario’ enhances memory layout and buffer organization, using multiple dedicated buffers for each encryption stage. The upgraded version provides detailed file processing information and continues targeting VM files, renaming encrypted files with the ‘.emario’ extension and leaving ransom notes. Although RansomHouse remains mid-tier in attack volume, its advanced tooling development indicates a strategic focus on efficiency and evasion, posing a growing challenge for decryption and static analysis.