RansomHouse Ransomware Recovery: MrAgent and the Mario ESXi Encryptor
RansomHouse was first seen in December 2021 and started out presenting itself as a data-leak operation. Trellix reported that it mostly hit Italy in 2022 and moved to the United States in 2023. ransomware.live counts about 210 victim claims, and it was still posting victims in October 2026.
MrAgent and the Mario encryptor
In February 2024 Trellix described MrAgent, a RansomHouse tool that runs on VMware ESXi hypervisors and automates the attack across large virtual environments. It connects back to the attackers, reports which virtual machines are running, can disable the hypervisor firewall, drop SSH sessions and set a new host password, and then downloads and runs the Mario encryptor on the hypervisor so that every VM's files are encrypted at once. Palo Alto Networks Unit 42 later reported an upgrade to RansomHouse's encryption.
RansomHouse ransomware data recovery: what we recover
We examine the encrypted VMDK files on the datastores, measure which regions were encrypted, and recover the guest file systems, SQL Server and Oracle databases and files from the intact parts. Veeam backup files are examined the same way.
Do not reinstall ESXi or reformat the datastores. Copy the encrypted virtual disks and contact us for a free assessment. No data, no charge.
Veeam backups, SQL Server or Oracle databases encrypted by RansomHouse?
Ransomware groups go after the backup repository first. A .vbk or .vib file renamed by the ransomware is often not lost: large backup files are usually only partly encrypted, and the intact blocks can be verified and rebuilt into the virtual disks. The same holds for SQL Server MDF and BAK files and for Oracle datafiles and Data Pump exports: the rows the ransomware did not reach can be read directly. In real cases we rebuilt a 466 GB server disk from a 43 GB Akira-encrypted VBK, and recovered 98.8% of the rows from LockBit-encrypted SQL Server backups.
- Ransomware-encrypted Veeam VBK recovery →
- AS VBK Recovery Studio: free analysis of an encrypted VBK →
- Ransomware-encrypted SQL Server database recovery →
- AS SQL Recovery & Repair Studio: free analysis of an encrypted MDF or BAK →
- Ransomware-encrypted Oracle database recovery →
- NAS and RAID ransomware recovery →
- Ransomware-encrypted VMware VMDK recovery →
RansomHouse ransomware data recovery: contact us now
We have already solved 656+ ransomware and data recovery cases: encrypted and corrupted SQL Server, Oracle and MySQL databases, Tally, Busy and Marg ERP data, Veeam backups, VMware and Hyper-V virtual machines, RAID and NAS. Send us the details and we tell you what we can recover.
- ✓ Free assessment before you pay anything
- ✓ No data, no charge
- ✓ NDA on request
Email: info [at] asittech.com · Mon–Fri, 9:00–18:00 IST