VanHelsing

VanHelsing is a ransomware-as-a-service (RaaS) operation first promoted on cybercrime platforms on March 7, 2025, including RAMP, and described as a rapidly growing multi-platform ransomware family. It targets Windows systems and is also advertised for Linux, BSD, ARM, and ESXi environments. Reported behavior includes encrypting files with the .vanhelsing extension, dropping a README.txt ransom note in affected folders, changing the desktop wallpaper to vhlocker.png, targeting local and network drives, processing files in roughly 1 MB chunks, deleting shadow copies to inhibit recovery, using process hollowing for defense evasion, and supporting command-line options such as --Silent and --no-logs. It reportedly creates the mutex Global\VanHelsing and has been associated with lateral movement via PsExec. Victim communications and extortion infrastructure reportedly use onion domains, TOX, and Bitcoin, with observed ransom demands reaching about $500,000. The RaaS model reportedly requires a $5,000 affiliate deposit and splits proceeds 80/20 between affiliates and operators. Multiple sources state that the operation forbids targeting Russia and other CIS-linked organizations. In mid-2025, the operation published source code for its affiliate panel, data leak blog, and Windows encryptor builder after a former developer using the alias th30c0der allegedly tried to sell the code on the RAMP forum for $10,000. Reporting states the leaked materials included a legitimate Windows builder, Windows encryptor source, a decryptor, a loader, and evidence of development toward an MBR locker, but did not include the Linux builder or databases. The leaked builder reportedly depended on an affiliate panel, previously observed at 31.222.238[.]208, and the panel code included an api.php endpoint. The operators claimed the released code was old and said they planned to return with an updated version branded VanHelsing 2.0. The source-code leak raised concerns about copycat attacks and broader reuse by other threat actors.