Back to threat feeds
Ransomware
VanHelsing RaaS: 2025’s $5k Cyber Menace Hits 3 Victims
VanHelsing RaaS 2025: $5k Cyber Threat Targets Windows, Linux, ESXi. Double Extortion & Evasion Tactics Exposed. Mitigate Now
Continue reading
VanHelsing RaaS 2025: $5k Cyber Threat Targets Windows, Linux, ESXi. Double Extortion & Evasion Tactics Exposed. Mitigate Now
Continue reading
A new emerging ransomware-as-a-service (RaaS) operation, dubbed VanHelsing, has rapidly escalated cybersecurity concerns globally after compromising three high-profile victims within weeks of its launch on 7 March 2025. Security researchers at Check Point warn that the group’s sophisticated tools, affiliate-driven model, and cross-platform capabilities position it as a formidable threat to businesses and governments. The emergence of VanHelsing coincides with a broader surge in ransomware attacks, with February 2025 marking the worst month in history for such incidents, according to cybersecurity firm Bitdefender.
VanHelsing’s RaaS model democratizes cybercrime by allowing seasoned hackers and newcomers to participate for a $5,000 deposit, which is waived for affiliates with proven reputations. Affiliates retain 80% of ransom payments, while the operators pocket 20%, incentivizing rapid adoption. The group explicitly prohibits attacks on the Commonwealth of Independent States (CIS), a common tactic among cybercriminal syndicates to avoid retaliation from Russia-aligned hacking collectives. Check Point’s report highlights VanHelsing’s “user-friendly” control panel, which supports desktop and mobile devices—even featuring dark mode—and enables affiliates to target Windows, Linux, BSD, Arm, and ESXi systems.
The ransomware employs a double extortion strategy, stealing sensitive data before encrypting files and appending the “.vanhelsing” extension. Victims receive a ransom note demanding Bitcoin payments, while their desktop wallpapers are altered to amplify psychological pressure. The C++-based malware also deletes shadow copies to hinder system recovery. It uses command-line arguments to customize attacks, such as spreading to SMB servers or operating in “Silent” mode to delay file renaming. CYFIRMA reports that government agencies, pharmaceutical firms, and manufacturers in France and the U.S. have fallen prey to the group.
VanHelsing’s rise mirrors a broader shift in ransomware tactics. New variants of Albabat ransomware now target Linux and macOS systems. In contrast, BlackLock—a rebranded version of the notorious Eldorado ransomware—has become one of 2025’s most active RaaS groups, focusing on technology, finance, and retail sectors. BlackLock recruits “traffers” to deploy malicious pages that infect victims with malware, enabling initial access for follow-up attacks. Meanwhile, the SocGholish framework (aka FakeUpdates) is being leveraged to distribute RansomHub ransomware, attributed to the threat group Water Scylla.
Critical vulnerabilities in Fortinet firewall appliances (CVE-2024-55591 and CVE-2025-24472) are also being exploited by a threat actor known as Mora_001 to deploy SuperBlack, a modified version of LockBit 3.0 equipped with custom data exfiltration tools. Simultaneously, the Babuk2 group is recycling data from past breaches linked to RansomHub and LockBit to issue fake extortion demands, capitalizing on victims’ fears of reputational damage.
Bitdefender’s data reveals ransomware hit a historic peak in February 2025, with 962 victims publicly listed—a 126% increase from February 2024. The Cl0p RaaS group alone claimed 335 victims, underscoring the scalability of the RaaS ecosystem. Sophos reports a 50% year-over-year surge in remote encryption attacks, where hackers compromise unmanaged devices to encrypt data on domain-joined networks. This trend reflects attackers’ growing focus on exploiting visibility gaps, with remote encryption incidents rising 141% since 2022.
_“Remote encryption is now a standard tool for ransomware groups,”_ said Chester Wisniewski, Sophos’ Global Field CISO. “Cybercriminals are aggressively targeting blind spots in corporate networks, often using unsecured endpoints as entry points. Organisations must prioritise comprehensive monitoring to detect suspicious file activity before it escalates.”
Experts urge organizations to adopt proactive defences, including patching known vulnerabilities like those in Fortinet appliances, enforcing network segmentation, and maintaining offline backups. Endpoint detection and response (EDR) tools are critical for identifying anomalies, particularly in SMB traffic and remote encryption attempts. Employee training to recognize phishing and social engineering tactics remains vital, as groups like BlackLock increasingly rely on “traffers” to lure victims.
The importance of threat intelligence sharing has been recognised. Businesses are advised to monitor for indicators of compromise (IoCs) such as the “.vanhelsing” extension, Bitcoin wallet addresses linked to VanHelsing, and unexpected desktop wallpaper changes. Collaboration with cybersecurity firms and government agencies is also recommended to stay ahead of evolving tactics.
As ransomware groups refine their strategies—prioritising cross-platform compatibility, rebranding, and exploiting unpatched vulnerabilities—the VanHelsing operation exemplifies the growing sophistication of cybercrime. With frequent updates and a polished interface, VanHelsing is poised to attract more affiliates, amplifying its global impact. For businesses, the stakes have never been higher: holistic visibility, zero-trust frameworks, and rapid incident response are no longer optional but essential to surviving the ransomware era.
148 malicious npm packages masquerading as student proxy and school Wi-Fi bypass tools. Rather than compromising developers during installation
