Found 13 bookmarks
Custom sorting
VanHelsing, new RaaS in Town
VanHelsing, new RaaS in Town
  • VanHelsingRaaS is a new and rapidly growing ransomware-as-a-service (RaaS) affiliate program launched on March 7, 2025. The RaaS model allows a wide range of participants, from experienced hackers to newcomers, to get involved with a $5,000 deposit. Affiliates keep 80% of the ransom payments, while the core operators earn 20%. The only rule is not to target the Commonwealth of Independent States (CIS). Check Point Research discovered two VanHelsing ransomware variants targeting Windows, but as the RaaS mentions in its advertisement, it provides more offerings “targeting Linux, BSD, ARM, and ESXi systems”. The program provides an intuitive control panel that simplifies operating ransomware attacks. Check Point Research obtained two variants of the VanHelsing Ransomware, compiled just five days apart. The newest variant shows significant updates, highlighting the fast-paced evolution of this ransomware. In less than two weeks since its introduction to the cybercrime community, this ransomware operation has already infected three known victims, demanding large ransom payments for decryption and the deletion of stolen data. During negotiations, they demanded $500,000 to be paid to a specified Bitcoin wallet.
#checkpoint#EN#2025#research#VanHelsing#RaaS#VanHelsingRaaS
·research.checkpoint.com·
VanHelsing, new RaaS in Town
VanHelsing Ransomware
VanHelsing Ransomware
orums as part of our Threat Discovery Process. Designed to target Windows systems, this ransomware employs advanced encryption techniques and appends a unique file extension to compromised files. Its stealthy evasion tactics and persistence mechanisms make detection and removal challenging. This highlights the need for proactive cybersecurity measures and a robust incident response strategy to safeguard data integrity and minimize breach risks. Target Technologies: Windows Target Geography: France, USA. Target Industry: Government, Manufacturing, Pharma. Encrypted file extension: .vanhelsing Observed First: 2025-03-16 Threat actor Communication mode: Tor
#cyfirma#EN#2025#VanHelsing#Ransomware#analysis#RaaS
·cyfirma.com·
VanHelsing Ransomware
Threat Spotlight: Inside the World's Fastest Rising Ransomware Operator — BlackLock
Threat Spotlight: Inside the World's Fastest Rising Ransomware Operator — BlackLock
First observed in March 2024, “BlackLock” (aka El Dorado or Eldorado) has rapidly emerged as a major player in the ransomware-as-a-service (RaaS) ecosystem. By Q4 2024, it ranked as the 7th most prolific ransomware group on data-leak sites, fueled by a staggering 1,425% increase in activity from Q3. BlackLock uses a double extortion tactic—encrypting data while stealing sensitive information—to pressure victims with the threat of public exposure. Its ransomware is built to target Windows, VMWare ESXi, and Linux environments, though the Linux variant offers fewer features than its Windows counterpart.
#reliaquest#EN#2025#BlackLock#Eldorado#RaaS#analysis#ransomware#gang
·reliaquest.com·
Threat Spotlight: Inside the World's Fastest Rising Ransomware Operator — BlackLock
Kryptina RaaS | From Unsellable Cast-Off to Enterprise Ransomware
Kryptina RaaS | From Unsellable Cast-Off to Enterprise Ransomware
Kryptina's adoption by Mallox affiliates complicates malware tracking as ransomware operators blend different codebases into new variants. Kryptina evolved from a free tool on public forums to being actively used in enterprise attacks, particularly under the Mallox ransomware family. In May 2024, a Mallox affiliate leaked staging server data, revealing that their Linux ransomware was based on a modified version of Kryptina. The affiliate made superficial changes to source code and documentation, stripping Kryptina branding but retaining core functionality. The adoption of Kryptina by Mallox affiliates exemplifies the commoditization of ransomware tools, complicating malware tracking as affiliates blend different codebases into new variants. * This original research was presented by the author at LABScon 2024 in Scottsdale, Arizona.
#sentinelone#EN#2024#Kryptina#RaaS#Mallox#Ransomware#analysis#LABScon2024
·sentinelone.com·
Kryptina RaaS | From Unsellable Cast-Off to Enterprise Ransomware
Uncovering the Dark Web Underground Forum: “Exploit.in” a Nexus for Illicit Cyber Activities
Uncovering the Dark Web Underground Forum: “Exploit.in” a Nexus for Illicit Cyber Activities
In the hidden corners of the internet, a parallel economy thrives—one that operates beyond the reach of conventional search engines and law enforcement agencies. Dark Web Forums have become the breeding grounds for cybercriminals. In the world of cybersecurity, Exploit in is a well-known private Russian hacker forum. Since it began in 2012, the forum has developed into a well-known exchange and sales platform for various cybercrime tools and stolen data. A wide range of cybercrime-related topics are covered by Exploit, such as credit card information, email spamming tools, social engineering, security & vulnerabilities, social network hacking, cryptography, cracked tools, buying and selling of hacked databases, info-stealer & Malware as a service (Maas). The creators of Exploit, a well-known cybercrime forum where ransomware gangs recruit affiliates and promote their Ransomware-as-a-Service (RaaS) offerings, have declared that ransomware advertisements are no longer permitted and will be taken down.
#falconfeeds#EN#2023#RaaS#Maas#Cyber-threat-intelligence#Darkweb-Monitoring#Exploit.in
·falconfeeds.io·
Uncovering the Dark Web Underground Forum: “Exploit.in” a Nexus for Illicit Cyber Activities
GhostSec offers Ransomware-as-a-Service Possibly Used to Target Israel
GhostSec offers Ransomware-as-a-Service Possibly Used to Target Israel
The hacker collective called GhostSec has unveiled an innovative Ransomware-as-a-Service (RaaS) framework called GhostLocker. They provide comprehensive assistance to customers interested in acquiring this service through a dedicated Telegram channel. Presently, GhostSec is focusing its attacks on Israel. This move represents a surprising departure from their past activities and stated agenda.
#Uptycs#EN#2023#GhostSec#GhostLocker#RaaS#Telegram#Israel
·uptycs.com·
GhostSec offers Ransomware-as-a-Service Possibly Used to Target Israel
You’ve been kept in the dark (web): exposing Qilin’s RaaS program
You’ve been kept in the dark (web): exposing Qilin’s RaaS program
All you need to know about Qilin ransomware and its operations targeting critical sectors. Group-IB’s Threat Intelligence team infiltrated the Qilin ransomware group in March 2023 and now can reveal inside information about this RaaS program. The blog provides recommendations on how to prevent Qilin’s attacks and will be useful for threat intelligence experts, threat hunters, and corporate cybersecurity teams.
#group-ib#EN#2023#Qilin#RaaS#infiltrated
·group-ib.com·
You’ve been kept in the dark (web): exposing Qilin’s RaaS program
What is ransomware-as-a-service and how is it evolving?
What is ransomware-as-a-service and how is it evolving?
Ransomware attacks are becoming more frequent and costlier—breaches caused by ransomware grew 41 percent in the last year, the average cost of a destructive attack rising to $5.12 milllion. What’s more, a good chunk of the cyber criminals doing these attacks operate on a ransomware-as-a-service (RaaS) model.
#malwarebytes#EN#2022#ransomware-as-a-service#RaaS
·malwarebytes.com·
What is ransomware-as-a-service and how is it evolving?
What is ransomware-as-a-service and how is it evolving?
What is ransomware-as-a-service and how is it evolving?
Ransomware attacks are becoming more frequent and costlier—breaches caused by ransomware grew 41 percent in the last year, the average cost of a destructive attack rising to $5.12 milllion. What’s more, a good chunk of the cyber criminals doing these attacks operate on a ransomware-as-a-service (RaaS) model.
#malwarebytes#EN#2022#ransomware-as-a-service#RaaS
·malwarebytes.com·
What is ransomware-as-a-service and how is it evolving?