Hellcat Ransomware
TrackedThreat actor group tracked in the global ransomware database · Last disclosure: Apr 10, 2025
ThreatAI Analysis
Compiled from the ransomware.live profile for Hellcat and from this database. Figures and technique mappings are quoted from the source data, not inferred.
Hellcat is a ransomware-as-a-service group responsible for attacks on 20 victims across 13 countries, including the United States, China, and Germany, striking sectors such as technology, education, and financial services with stealthy initial access via stolen credentials.
Who Hellcat is
HellCat is a ransomware-as-a-service group that formed in Q4 2024 and quickly became notable for high-profile attacks against Schneider Electric, Telefónica, and Israel's Knesset, primarily gaining initial access via stolen Jira credentials harvested by infostealer malware, targeting critical infrastructure and government entities.
Recorded activity
Disclosures attributed to Hellcat in this database run from October 2024 to April 2025, totalling 20 victims — 0.1% of everything tracked here. Hellcat has listed victims in 13 countries in this database, most often United States, followed by China and France. The sectors appearing most in its listings are Technology, Education, Financial Services.
YARA detection rules
hellcat.yar
/*
HellCat ransomware
*/
rule HellCat_Ransomnote
{
meta:
author = "ransomware.live"
family = "ransomware.hellcat"
description = "Detects HellCat ransomware ransom note"
date = "2026-05-04"
severity = 7
score = 70
strings:
$s1 = "HellCat" ascii nocase
$s2 = "HELLCAT" ascii
$s3 = "hellcat.onion" ascii nocase
condition:
any of them
}Community-contributed rules for Hellcat, reproduced as published. Test them against your own corpus before relying on them: rule quality and false-positive behaviour vary by author.
Threat Actor Analysis
Hellcat is a ransomware threat group that has disclosed 20 victims in publicly accessible leak site data, representing 0.1% of all ransomware attacks tracked in this database. The earliest victim disclosure attributed to Hellcat in our dataset dates to October 2024.
Geographically, Hellcat has targeted organisations in 13 countries. The most frequently targeted nation is United States with 6 victim organisations. Other heavily targeted nations include China, France, Germany.
Industry-wise, Hellcat shows a concentration in the Technology, Education, Financial Services sectors. These industries are frequently targeted because they manage sensitive data, critical operations, or have lower tolerance for operational downtime — conditions that increase ransom payment likelihood.
Like most modern ransomware operations, Hellcat likely employs a double extortion model: encrypting victim files while simultaneously exfiltrating data, creating dual pressure to pay the ransom. Victim organisations that refuse payment face having their data published on the group's dark web leak site.
Note: This profile is generated from public leak site disclosures aggregated via the ransomware.live API. Data is updated automatically. The table below lists the 20 most recent of the 20 disclosures we hold for this group; use the link beneath it to page through all of them.
Recent Victim Disclosures (showing 20 of 20)
| # | Organization | Country | Sector | Date |
|---|---|---|---|---|
| 1 | Potomac Financial Services potomacfinancialadvisors.com | 🇺🇸 United States | Financial Services | Apr 10, 2025 |
| 2 | CVTE cvte.com | 🇨🇳 China | Technology | Apr 7, 2025 |
| 3 | P**o*** p**********.com | — | Financial Services | Apr 7, 2025 |
| 4 | Asseco asseco.com | 🇵🇱 Poland | Technology | Apr 5, 2025 |
| 5 | HighWire Press highwirepress.com | 🇺🇸 United States | Technology | Apr 5, 2025 |
| 6 | LeoVegas AB leovegasgroup.com | 🇸🇪 Sweden | Telecommunication | Apr 5, 2025 |
| 7 | Racami racami.com | 🇺🇸 United States | Technology | Apr 5, 2025 |
| 8 | Transsion Holdings transsion.com | 🇨🇳 China | Technology | Mar 29, 2025 |
| 9 | Grupo Santillana santillana.com | 🇪🇸 Spain | Education | Mar 25, 2025 |
| 10 | Omnitracs omnitracs.com | 🇺🇸 United States | Technology | Mar 25, 2025 |
| 11 | Electronics For Imaging efi.com | 🇺🇸 United States | Technology | Mar 17, 2025 |
| 12 | Ascom Holding AG ascom.com | 🇨🇭 Switzerland | Technology | Mar 16, 2025 |
| 13 | OneDealer onedealer.com | 🇩🇪 Germany | Consumer Services | Feb 28, 2025 |
| 14 | Car Care Plan - Turkey carcareplan.com.tr | 🇹🇷 Turkey | Consumer Services | Dec 26, 2024 |
| 15 | Pinger - USA pinger.com | 🇺🇸 United States | Business Services | Dec 25, 2024 |
| 16 | Sistem Informasi Pengelolaan Keuangan Daerah (SIPKD) kemendagri.go.id | 🇮🇩 Indonesia | Public Sector | Dec 25, 2024 |
| 17 | College of Business - Tanzania cbe.ac.tz | TZ | Education | Nov 4, 2024 |
| 18 | Ministry of Education - Jordan moe.gov.jo | 🇯🇴 Jordan | Education | Nov 4, 2024 |
| 19 | Schneider Electric - France se.com | 🇫🇷 France | Energy | Nov 4, 2024 |
| 20 | The Knesset - Israel knesset.gov.il | 🇮🇱 Israel | Public Sector | Oct 25, 2024 |
Frequently Asked Questions
What is Hellcat ransomware?
Hellcat is a ransomware threat group that has claimed 20 victims since its first known activity in October 2024. The group operates by infiltrating target networks, exfiltrating data, encrypting files, and threatening to publish stolen data on a dark web leak site if the ransom is not paid.
How many victims has Hellcat attacked?
Hellcat has claimed 20 victims in our database, representing 0.1% of all tracked ransomware attacks. The most targeted countries are United States, China, France, Germany.
Which countries does Hellcat target?
Hellcat has attacked organizations in 13 countries. The top targeted countries are: United States, China, France, Germany.
Which industries does Hellcat target?
Hellcat most frequently targets the Technology, Education, Financial Services sectors based on victim disclosures in our database.
Is Hellcat still active?
Hellcat's most recent victim disclosure in our database was on April 10, 2025. Ransomware groups frequently rebrand or go dormant; monitor this page and our ransomware map for the latest activity.