Hellcat ransomware

Who Hellcat is

HellCat is a ransomware-as-a-service group that formed in Q4 2024 and quickly became notable for high-profile attacks against Schneider Electric, Telefónica, and Israel's Knesset, primarily gaining initial access via stolen Jira credentials harvested by infostealer malware, targeting critical infrastructure and government entities.

Recorded activity

Disclosures attributed to Hellcat in this database run from October 2024 to April 2025, totalling 20 victims — 0.1% of everything tracked here. Hellcat has listed victims in 13 countries in this database, most often United States, followed by China and Germany. The sectors appearing most in its listings are Technology, Education, Financial Services.

Indicators of compromise

• [email protected]

Showing a sample of 1 EMAIL on file. Hashes and network indicators published for Hellcat. Leak-site addresses are deliberately excluded. Indicators age quickly — treat a match as a starting point for investigation, and an absence of matches as no assurance.

YARA detection rules

/*
HellCat ransomware
*/

rule HellCat_Ransomnote
{
    meta:
        author = "ransomware.live"
        family = "ransomware.hellcat"
        description = "Detects HellCat ransomware ransom note"
        date = "2026-05-04"
        severity = 7
        score = 70

    strings:
        $s1 = "HellCat" ascii nocase
        $s2 = "HELLCAT" ascii
        $s3 = "hellcat.onion" ascii nocase

    condition:
        any of them
}

Community-contributed rules for Hellcat, reproduced as published. Test them against your own corpus before relying on them: rule quality and false-positive behaviour vary by author.