Loading story…
Fortinet reported the emergence of VanHelsing, a Windows-focused ransomware family that encrypts victim files, appends extensions including .vanlocker and .vanhelsing, drops a README.txt ransom note, and changes the victim’s desktop wallpaper. The malware directs victims to TOR-based negotiation portals and a dedicated data leak site, and Fortinet identified at least two related samples that share the same extortion infrastructure despite using different encrypted-file extensions.
The leak site listed multiple victims across the United States, Italy, France, and Australia, with manufacturing appearing most affected, although one identified victim was a U.S. municipal government organization, indicating the operators may not limit attacks by sector. The activity reflects a double-extortion model in which data theft and public shaming accompany file encryption, while U.S. Treasury guidance continues to warn that ransomware incidents can carry sanctions compliance risks when payments involve blocked persons or jurisdictions.
TTPs, infrastructure, and targeting history in one profile.
3 events from the most recent confirmed update back to the earliest known activity.
Fortinet observed that the VanHelsing data leak site had grown to seven listed victims by mid-April 2025, indicating continued victimization and public extortion activity.
During Fortinet's initial investigation in late March 2025, the VanHelsing TOR-based data leak site listed six victims across multiple countries and sectors.
Fortinet reported that the first VanHelsing ransomware sample was made available on a publicly accessible file-scanning site in mid-March 2025, marking the family's earliest observed appearance.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**AnteFrigus** is a low-prevalence crypto-ransomware family that encrypts victim files with **AES**, appends random file extensions, and drops a ransom note as a randomly named `-readme.txt` file. The malware has primarily targeted English-speaking users but can affect victims globally, and observed samples avoided encrypting the `C:` drive while locking files on removable media and mapped network drives such as `D:` through `I:`. Victims were directed to pay through a **Tor** portal or contact `antefrigus@cock.li`, with ransom demands starting at **$1,995** and rising to **$3,990** after four days. Researchers linked AnteFrigus to the **Prometey** ransomware line and reported distribution through the **HookAds** malvertising campaign redirecting users to the **RIG exploit kit**, alongside possible delivery via exposed **RDP**, spam, malicious attachments, fake updates, botnets, and repacked installers. The malware reportedly used **iplogger.org** to identify the infected host’s IP address and skipped encrypting selected executable and system-related file types. Later variants adopted extensions including `.eaaeee`, `.bbadc`, `.aceadf`, `.daaefc`, and `.feeef`, and shifted to new ransom note names and payment sites such as `recovery-help.top` and `restore-now.top`.
Aug 15, 2026
Ransomware activity remained elevated across multiple regions and sectors, with recent victim claims spanning U.S. healthcare and professional services, Romanian education, Italian ICT, and U.S. technology firms. **DragonForce** claimed attacks on Deluxe Medical Supply and Syntron Bioresearch, while **Qilin** was linked to a breach at Romania’s Universitatea de Vest „Vasile Goldiș” din Arad, **nova** to Italian ICT provider SistNet, **Akira** to digital marketing firm Emerge2 Digital, and **incransom** to Health Law Advocates in Boston. Several of the incidents involved alleged data theft in addition to encryption, with actors threatening publication of stolen corporate, client, financial, and operational records. Broader reporting shows the surge is part of a sustained multinational ransomware wave. An ASEC June 2026 threat report said manufacturing was the most affected sector globally, the **United States** had the highest incident volume, and **Qilin**, **Dire Wolf**, and **World Leaks** were the most active groups by leak-site postings; it also noted **LockBit 5.0** had shifted from fixed TOR leak domains to victim-specific domains and private torrent distribution. Separate tracking of Italy found **148 confirmed ransomware claims** against organizations in the first half of 2026, with manufacturing the top target and **LockBit5** and **Qilin** the leading groups, while common intrusion paths included reused credentials, exposed RDP, and unpatched internet-facing systems.
Jul 27, 2026
FortiGuard Labs said the **DeathRansom** ransomware campaign is strongly tied to **Vidar** stealer activity and several other malware operations through shared infrastructure, naming conventions, and recurring attribution artifacts. Researchers found Vidar samples attempting to access Bitbucket paths under the profile name **`scat01`** and likely retrieving DeathRansom variants named in the **`Wacatac_YYYY-MM-DD_HH-MM.exe`** format. The same cluster was also linked to **Azorult**, **Evrial stealer**, **1ms0rryStealer**, and **Supreme miner**, with repeated use of identifiers including the nickname **`scat01`**, the email **`vitasa01@yandex.ru`**, and the domain **`gameshack[.]ru`**. FortiGuard assessed that false Slovak and Nepali language artifacts were likely planted to mislead investigators, while other evidence pointed to a Russian-speaking operator associated with the online persona **SoftEgorka** and likely connected to **Egor Nedugov** from the Rostov-on-Don/Aksay area. Separate technical profiling described DeathRansom, also detected in some cases as **Wacatac**, as a ransomware family that evolved from early variants that sometimes only mimicked encryption into later builds that performed real file encryption. The malware primarily targeted English-speaking users, dropped a **`read_me.txt`** ransom note, demanded Bitcoin payment through attacker-controlled email addresses, and checked systems against a whitelist of CIS-region languages before running. Analysts documented multiple delivery paths, including **RDP compromise**, spam, malicious downloads, botnets, exploits, malvertising, fake updates, and trojanized installers, and noted changing cryptographic implementations involving **Curve25519/ECDH**, **Salsa20**, **RSA-2048**, **AES**, and **SHA-256**. The reporting also noted code or family relationships with **EZDZ-Locker**, **TechandStrat**, **HelloKitty**, **FiveHands**, **DCRTR**, and **STOP** ransomware.
Aug 15, 2026