MrAgent is a ransomware/attack tool linked to the RansomHouse operation.
MrAgent is a tool tracked across 1 threat cluster and 2 intelligence report mentions on ThreatCluster. First observed December 20, 2025; most recent activity December 22, 2025.
MrAgent is a ransomware/attack tool linked to the RansomHouse operation. It forms part of an upgraded toolkit that enables multi-layer encryption and greater resilience against countermeasures, signaling a shift toward more sophisticated and harder-to-counter ransomware campaigns.
RansomHouse, a ransomware-as-a-service operation, has upgraded its encryption method from a single-phase to a multi-layered dual-key architecture. This change enhances the complexity of its extortion tactics, providing…
MrAgent is a ransomware/attack tool linked to the RansomHouse operation.
The most recent intelligence report mentioning MrAgent on ThreatCluster is dated December 22, 2025. Activity was first observed December 20, 2025, giving a tracked span from then to December 22, 2025.
Across ThreatCluster reporting, MrAgent most frequently co-occurs with Ransomware, Askul Corporation, Finance, Government, Healthcare, among 9 tracked related entities.
The most significant recent cluster is “RansomHouse Ransomware Upgrades to Multi-Layered Encryption” (2 articles · Updated December 22, 2025). MrAgent appears across 1 threat cluster in total, listed above with sources.
MrAgent appears in 2 intelligence report mentions across 1 deduplicated threat cluster, aggregated from 17,000+ monitored sources.