From 36a1466661ff64543d4f6f8615297f596bda31d4 Mon Sep 17 00:00:00 2001
From: Mathieu Beligon <mathieu@feedly.com>
Date: Mon, 23 May 2022 11:29:39 +0200
Subject: [PATCH] [threat-actors] Add RansomHouse

---
 clusters/threat-actor.json | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index fd67d7c..8629386 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -9319,6 +9319,19 @@
       },
       "uuid": "7ab283ac-b78f-42db-b564-0550b9637b0b",
       "value": "TA579"
+    },
+    {
+      "description": "This group started operating during the first quarter of 2022. They published samples of alleged stolen data from companies on their site on Tor. It is unclear if they conducted the attacks themselves, or if they bought leaked databases from third parties.",
+      "meta": {
+        "refs": [
+          "https://webz.io/dwp/new-ransomware-group-ransomhouse-is-it-real-or-fake/"
+        ],
+        "cfr-target-category": [
+          "Private sector"
+        ]
+      },
+      "uuid": "4d522fad-452c-46be-94ea-5803aec9b709",
+      "value": "RansomHouse"
     }
   ],
   "version": 227