VanHelsing ransomware emerges to put a stake through your Windows heart
(2025/03/25)
- Reference: 1742887927
- News link: https://www.theregister.co.uk/2025/03/25/vanhelsing_ransomware_russia/
- Source link:
Check Point has spotted a fresh ransomware-as-a-service crew in town: VanHelsing, touting a cross-platform locker targeting Microsoft Windows, Linux, and VMware ESXi systems, among others. But so far, only Windows machines have fallen victim, we're told.
Launched on March 7, this RaaS operation has already infected three organizations with ransom demands amounting to $500,000 a victim. Check Point's analysis [1]suggests VanHelsing is a freshly developed ransomware strain, rather than a quick rebrand of existing malware code.
Newcomers looking to try their hand at spreading ransomware and infecting victims need to cough up a $5,000 deposit to join the VanHelsing affiliate program, while seasoned cybercrooks with a solid reputation can skip the fee. The payout split favors affiliates, who pocket 80 percent of ransom payments, leaving the remaining 20 percent for the RaaS operators. It's up to the affiliates to figure out how to get the malware onto a victim's network; think booby-trapped emails and downloads.
[2]
So far, VanHelsing's victims have all been Windows users, according to Check Point, despite the RaaS touting cross-platform support, from Microsoft's OS to BSD and including Arm-based devices. Researchers analyzed two distinct Windows samples compiled five days apart. The affiliate program offers a control panel designed to streamline infections, lowering the technical bar for would-be cybercriminals. Development is clearly ongoing, with several incomplete features, unimplemented commands, and quick-fire updates between observed versions.
[3]
[4]
"The ransomware is really fresh," Eli Smadja, research group manager at Check Point, told The Register Monday.
"For example, they published the first announcement of the creation of the affiliate program on March 7. And then the first sample that we see, it was on the 11th, and we see another one on the 16th.
[5]
"In almost 10 days, we found two Windows samples and three victims. Currently, we haven't seen any of the other ones, like Linux or other systems, because we read like some mentions that some affiliates tested some versions as well."
[6]Names, bank info, and more spills from top sperm bank
[7]Attackers swipe data of 500k+ people from Pennsylvania teachers union
[8]Extortion crew threatened to inform Edward Snowden (?!) if victim didn't pay up
[9]So … Russia no longer a cyber threat to America?
One hard rule applies: No hitting targets in Russia and [10]other nations in the Commonwealth of Independent States. Various ransomware gangs have that red line, we note.
"This is difficult to say, but usually they are operating under Russian territory," Antonis Terefos, a malware reverse engineer at Check Point, told us.
"Recently there were some leaks from the Lockbit affiliate groups, and even the affiliates inside them are actually afraid that they are going to be hired by the Russian government to perform various attacks. That was interesting to see from the affiliate side."
Indeed, by this point it is evident the Russian government is willing to turn a blind eye to cyber-criminals that extort Western organizations, if not actively [11]works with ransomware gangs. Similar state-criminal cooperation has been [12]spotted in China. ®
Get our [13]Tech Resources
[1] https://research.checkpoint.com/2025/vanhelsing-new-raas-in-town/
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Z-KM3Aj5OWXiu_YekpIq_AAAAkA&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Z-KM3Aj5OWXiu_YekpIq_AAAAkA&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Z-KM3Aj5OWXiu_YekpIq_AAAAkA&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Z-KM3Aj5OWXiu_YekpIq_AAAAkA&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://www.theregister.com/2025/03/19/sperm_bank_data_leak/
[7] https://www.theregister.com/2025/03/19/pennsylvania_nonprofit_cyberattack/
[8] https://www.theregister.com/2025/03/18/extortionists_ox_thief_legal_threats/
[9] https://www.theregister.com/2025/03/04/russia_cyber_threat/
[10] https://en.wikipedia.org/wiki/Commonwealth_of_Independent_States#Member_states
[11] https://www.theregister.com/2025/02/12/ransomware_nation_state_groups/
[12] https://www.theregister.com/2025/02/14/chinese_spies_ransomware_moonlighting/
[13] https://whitepapers.theregister.com/
Launched on March 7, this RaaS operation has already infected three organizations with ransom demands amounting to $500,000 a victim. Check Point's analysis [1]suggests VanHelsing is a freshly developed ransomware strain, rather than a quick rebrand of existing malware code.
Newcomers looking to try their hand at spreading ransomware and infecting victims need to cough up a $5,000 deposit to join the VanHelsing affiliate program, while seasoned cybercrooks with a solid reputation can skip the fee. The payout split favors affiliates, who pocket 80 percent of ransom payments, leaving the remaining 20 percent for the RaaS operators. It's up to the affiliates to figure out how to get the malware onto a victim's network; think booby-trapped emails and downloads.
[2]
So far, VanHelsing's victims have all been Windows users, according to Check Point, despite the RaaS touting cross-platform support, from Microsoft's OS to BSD and including Arm-based devices. Researchers analyzed two distinct Windows samples compiled five days apart. The affiliate program offers a control panel designed to streamline infections, lowering the technical bar for would-be cybercriminals. Development is clearly ongoing, with several incomplete features, unimplemented commands, and quick-fire updates between observed versions.
[3]
[4]
"The ransomware is really fresh," Eli Smadja, research group manager at Check Point, told The Register Monday.
"For example, they published the first announcement of the creation of the affiliate program on March 7. And then the first sample that we see, it was on the 11th, and we see another one on the 16th.
[5]
"In almost 10 days, we found two Windows samples and three victims. Currently, we haven't seen any of the other ones, like Linux or other systems, because we read like some mentions that some affiliates tested some versions as well."
[6]Names, bank info, and more spills from top sperm bank
[7]Attackers swipe data of 500k+ people from Pennsylvania teachers union
[8]Extortion crew threatened to inform Edward Snowden (?!) if victim didn't pay up
[9]So … Russia no longer a cyber threat to America?
One hard rule applies: No hitting targets in Russia and [10]other nations in the Commonwealth of Independent States. Various ransomware gangs have that red line, we note.
"This is difficult to say, but usually they are operating under Russian territory," Antonis Terefos, a malware reverse engineer at Check Point, told us.
"Recently there were some leaks from the Lockbit affiliate groups, and even the affiliates inside them are actually afraid that they are going to be hired by the Russian government to perform various attacks. That was interesting to see from the affiliate side."
Indeed, by this point it is evident the Russian government is willing to turn a blind eye to cyber-criminals that extort Western organizations, if not actively [11]works with ransomware gangs. Similar state-criminal cooperation has been [12]spotted in China. ®
Get our [13]Tech Resources
[1] https://research.checkpoint.com/2025/vanhelsing-new-raas-in-town/
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Z-KM3Aj5OWXiu_YekpIq_AAAAkA&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Z-KM3Aj5OWXiu_YekpIq_AAAAkA&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Z-KM3Aj5OWXiu_YekpIq_AAAAkA&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Z-KM3Aj5OWXiu_YekpIq_AAAAkA&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://www.theregister.com/2025/03/19/sperm_bank_data_leak/
[7] https://www.theregister.com/2025/03/19/pennsylvania_nonprofit_cyberattack/
[8] https://www.theregister.com/2025/03/18/extortionists_ox_thief_legal_threats/
[9] https://www.theregister.com/2025/03/04/russia_cyber_threat/
[10] https://en.wikipedia.org/wiki/Commonwealth_of_Independent_States#Member_states
[11] https://www.theregister.com/2025/02/12/ransomware_nation_state_groups/
[12] https://www.theregister.com/2025/02/14/chinese_spies_ransomware_moonlighting/
[13] https://whitepapers.theregister.com/
The end result...
Mentat74
Or some Polonium tea or a nice Novichok sandwich...
Anonymous Coward
"What will happen if you sign up for this, and drop the malware off on"
From what I heard on the news, those kind of malware have geolocation checks, as well as keyboard layout checks, some even check for software used mostly in their location - to prevent them from running into the attacker's safe harbour area.
Mistakes do happen, but it is unlikely.
Oops...
Bebu sa Ware
I didn't realise there were still hosts using the .SU TLD. ;)
What will happen if you sign up for this, and drop the malware off on Russian hosts by accident? *whistling innercently*
The end result will be most probably a baseball bat to the knees, or a drone with a nasty payload flying into your house...