Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Enjoying ransomware.live? Help us keep tracking ransomware gangs and shipping new features. Support us

RansomHouse – Dual-Key Encryption Pattern: Mass Rename with Two Ransom Notes

Ransomhouse Encryption / Impact Sentinel
MITRE ATT&CK
Data Encrypted for Impact
Data Source
DeviceFileEvents
Date Added
2026-07-23
Last Updated
2026-07-23
Source
ransomware.live group profile (ransomhouse) – no group-specific tool/TTP telemetry on file; inference from the group's own described dual-key architecture
What This Detects
RansomHouse has moved to a multi-layered, dual-key encryption architecture per its own leak-site messaging; a reliable if generic signal is rapid mass file renaming paired with more than one distinct ransom-note filename dropped in the same operation.
Query
let massRename = DeviceFileEvents
| where Timestamp > ago(1d)
| where ActionType == "FileRenamed"
| summarize RenameCount = count(), Folders = dcount(FolderPath) by DeviceName, InitiatingProcessAccountName, bin(Timestamp, 10m)
| where RenameCount > 200 and Folders > 5;
let notes = DeviceFileEvents
| where Timestamp > ago(1d)
| where FileName has_any ("README","HOW_TO_RESTORE","DECRYPT")
| summarize NoteVariants = dcount(FileName) by DeviceName
| where NoteVariants >= 2;
massRename
| join kind=inner notes on DeviceName

Hunting queries are starting points for threat hunting & detection engineering — validate table/column names against your own workspace schema and tune thresholds before turning any of these into a production alert rule.