- Check Point -Scientists Found a New Ransomware -The Stem called Vanhelsing
- It is a growing threat in which affiliated companies have to pay a fee to get in
- Three organizations already became victim
A new dangerous ransomware -variant has been seen that is capable of encrypting Windows devices, Linux, VMware, ESXI systems and more.
CyberSecurity scientists Check Point revealed that malware is called Vanhelsing and works on a service model (Ransomware-A-A-Service).
The RAAS operation started on March 7, 2025, and the encryption is still under development. So far, several infections were stained and scientists managed to analyze a few variants, all on the Windows platform. Between them there were step -by -step updates, it was said that Vanhelsing is active – and quickly – developed.
Russian group?
So far, three organizations fell victim to Vanhelsing, each of which was asked for $ 500,000 in crypto in return for the decryption key. We do not know if the affiliated companies also participate in data exfiltration, but it is safe to assume they do.
Check Point also said that there seem to be different rules for wanting to be affiliated companies. Those who are new to the cyber criminal scene have to pay a $ 5,000 fee to be included as an affiliated company. More established names in the stage do not have to pay at all.
The division of revenue favors affiliated companies, it was further explained. It is a division of 80-20, with 20% going to Ransomware’s operators.
As for attribution, the operation is probably Russian as it is not allowed to target organizations in Russia or the Commonwealth of Independent States (formerly the Soviet Union, basically).
“This is difficult to say, but usually they operate under Russian territory,” noted Antonis Terefos, a malware -conversion engineer at the checkpoint.
The researchers also suggested that the Russian government is not targeting cyber criminals as long as they only attack organizations in the West.
If this is really the case and Vanhelsing is allowed to work freely, it can quickly become a productive threat actor competing with Lockbit or Ransomhub. In addition, it will be clear that ransomware has become a tool in global power struggles, something we have seen North Korea do for years now.
Via Registered
