RansomHouse
aka Jolly Scorpius
A group active since late 2021 that steals data and threatens to publish it. It has strengthened its ability to lock virtual server hosts all at once, hitting a wide range of organizations including healthcare and manufacturing.
- Alert level
- 1/ 5
- Reports & advisories (90 days)
- 0
- Known exploited CVEs
- 0
- Personal data leaked (disclosed)
- None confirmed
Exploited vulnerabilities and targeted products
If you run any of these products, first make sure they are updated to a fixed version.
How they attack
Inside
Taking over the virtualization host
Like seizing the building's main electrical room instead of breaking into each office.
Goal
Threatening to publish stolen data
Like photographing the safe's contents and threatening to post them around town unless paid.
Goal
Locking many systems at once
Like locking every floor of a building at once and demanding payment to reopen.
Sources
Attributions are quoted as assessed by governments and security vendors. VulnPulse does not make attributions itself.
Leak counts only add up figures disclosed by the affected companies or authorities, never the attackers' own claims. We do not list victim names or link to leak sites.
The alert level is calculated automatically from reports and advisories in the last 90 days, known exploited vulnerabilities, and whether the group has targeted Japan.
Updated 2026-10-23 · daily