Description Summary
Upgraded to a two-stage 'Mario' encryptor with MrAgent ESXi automation.
Threat Actor
Actor tracked as Jolly Scorpius; data-extortion + encryption double extortion.
Technical Indicators
Encryption Extension
Not publicly reported
Encryption Algorithm
'Mario' encryptor — two-stage (primary + secondary keys); MrAgent automates ESXi multi-host encryption
Ransom Note Name
Not publicly reported
Targeted Industries
Healthcare-heavy (cross-sector)
First Seen
Late 2021
Last Seen
Active
Geographical Location
US (~40%), Europe (~25%)
MITRE ATT&CK Matrix
| Tactic | TTP | Technique Name |
|---|---|---|
| Impact x 2 | T1486 | Data Encrypted for Impact |
| T1490 | Inhibit System Recovery | |
| Exfiltration x 1 | T1567 | Exfiltration Over Web Service (leak site) |
| Initial Access x 2 | T1190 | Exploit Public-Facing Application |
| T1078 | Valid Accounts |