Loading threat actor…
Helldown is a financially motivated ransomware and extortion group associated with attacks against organizations including healthcare entities. It operates a dedicated leak site used to publish victim claims. Its ransomware activity includes Windows systems and VMware ESXi environments, where encryption of virtual disk images can disrupt multiple virtual machines. Helldown-linked intrusions have involved initial access through Zyxel firewall SSL VPN connections, credential theft, internal network discovery, and Remote Desktop-based lateral movement. Observed techniques include modifying firewall access-control rules to weaken network segmentation, extracting credentials from Veeam configurations and databases, and deploying ransomware directly on ESXi hosts. Tools associated with the group include Mimikatz, Advanced Port Scanner, Advanced IP Scanner, and HRSword. Although Zyxel appliances have been implicated in its intrusion activity, exploitation of CVE-2024-42057 has not been definitively established for Helldown.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
10 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
1 malware family attributed to this actor across reporting.
1 CVE this actor has used in observed campaigns. 1 of them exploited in the wild.
6 indicators attributed to this actor. Values are masked here and available in full in Mallory.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.