Loading malware…
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Researchers observed that threat actors are actively exploiting vulnerabilities in Zyxel firewalls to gain initial access to targeted systems. A critical vulnerability, CVE-2024-42057 with CVSS 8.1, which allows unauthenticated code execution, is believed to be a significant attack vector.
In early December the Cybersecurity and Infrastructure Security Agency and German authorities warned of a directory traversal vulnerability in Zyxel firewalls being exploited to deploy Helldown ransomware.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
“All of this evidence strongly suggests that Zyxel firewalls have been targeted by Helldown. Details about post-compromise activities indicate that, in at least one intrusion, the attacker’s tactics align with typical ransomware methods.”
35 distinct techniques documented for this family, organized by ATT&CK tactic.
Defense Evasion T1027.002 Obfuscated Files or Information: Software Packing
Defense Evasion T1027.005 Obfuscated Files or Information: Indicator Removal from Tools
The Ransomware then deletes the dropped script and itself, and other artifacts, such as created registries
9 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Ransomware deployed via exploitation of a Zyxel firewall directory traversal vulnerability.
Ransomware family observed expanding capabilities to encrypt Linux systems.
Cross-platform ransomware targeting Windows and Linux systems. The Windows specimen encrypts files, changes their extensions and icons, uses anti-debugging and virtual-machine checks, interferes with Volume Shadow Copy recovery, deletes execution artifacts, and restarts the compromised system. The Linux specimen uses hardcoded XML configuration to guide file encryption and ransom-note generation. It includes functionality to terminate virtual instances before encryption, but researchers did not observe that functionality executing or any connection to malicious network infrastructure. The report links Helldown intrusions to compromised Zyxel firewalls and identifies CVE-2024-42057 as a suspected initial-access vector, rather than a conclusively established exploit.
Ransomware associated with a series of attacks analyzed by Sekoia. Researchers suspect its operators compromised Zyxel firewalls to gain initial access to organizations. The article discusses exploitation of CVE-2024-42057 but does not explicitly establish that Helldown exploited that specific vulnerability.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.