VanHelsing
VanHelsing is a ransomware-as-a-service (RaaS) operation first promoted on cybercrime platforms on March 7, 2025. It is described as a multi-platform ransomware operation targeting Windows, Linux, BSD, ARM, and ESXi systems. Reporting in the provided content states that VanHelsing expressly prohibits affiliates from targeting organizations in Russia and other CIS countries. The group has publicly claimed victims including the City of Belleville, ATOS Racks, MEDS Pharmacy, Studio Vallone, Compumedics Limited, CAS-CHILE, Alert Enterprise, and the Law Offices of David Kohn. One report cited in the content states Ransomware.live had identified eight known victims. The content also states that the VanHelsing operation published source code for its affiliate panel, data leak blog, and Windows encryptor builder after a former developer using the alias "th30c0der" allegedly attempted to sell the code on the RAMP cybercrime forum for $10,000. According to the reporting summarized in the content, the leaked materials included source code for the Windows encryptor, a decryptor, and a loader, and indicated development work toward an MBR locker. The operators characterized the released materials as "old" source code and stated they planned to return with an updated version branded "VanHelsing 2.0." Aliases directly reflected in the content: vanhelsing.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Where they're from
Attributed origin per open-source reporting.
- RU
Recent activity
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Ransomware-as-a-service group referenced as enforcing a no-CIS targeting rule for members and affiliates.
Named as a new ransomware variant/gang emerging in 2024 and associated with victim claims posted in March 2024.
New multi-platform RaaS promoted in March 2025; targets Windows/Linux/BSD/ARM/ESXi; offers affiliate panel automation and support; forbids targeting CIS (noted as common among Russian/pro-Russian cybercriminal groups).
Internal conflict led to source-code leak (including TOR keys, ransomware source, admin panel, chat system, file server, and blog database) on the RAMP forum—likely increasing copycat risk and enabling defenders to derive detections.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.