Helldown ransomware

Who Helldown is

Helldown is an aggressive ransomware group first documented in August 2024, known for exploiting Zyxel firewall vulnerabilities to gain initial access and conducting large-scale data exfiltration averaging 70 GB per victim, targeting IT services, telecommunications, manufacturing, and healthcare primarily in the US.

Recorded activity

Disclosures attributed to Helldown in this database run from August 2024 to November 2024, totalling 36 victims — 0.1% of everything tracked here. Helldown has listed victims in 17 countries in this database, most often United States, followed by Germany and Italy. The sectors appearing most in its listings are Business Services, Healthcare, Manufacturing.

Tooling observed in Helldown operations

• Mimikatz
• HRSword
• Advanced Port Scanner
• PsExec
• TeamViewer

Software reported in use by Helldown. Most are legitimate administration or transfer utilities; their presence in an environment is a signal to investigate, not proof of compromise.

Indicators of compromise

• [email protected]

Showing a sample of 1 EMAIL on file. Hashes and network indicators published for Helldown. Leak-site addresses are deliberately excluded. Indicators age quickly — treat a match as a starting point for investigation, and an absence of matches as no assurance.

YARA detection rules

/*
Helldown ransomware
*/

rule Helldown_Ransomnote
{
    meta:
        author = "ransomware.live"
        family = "ransomware.helldown"
        description = "Detects Helldown ransomware ransom note"
        date = "2026-05-04"
        severity = 7
        score = 70

    strings:
        $s1 = "Helldown" ascii nocase
        $s2 = "HELLDOWN" ascii
        $s3 = "helldown.onion" ascii nocase
        $s4 = ".helldown" ascii

    condition:
        any of them
}

Community-contributed rules for Helldown, reproduced as published. Test them against your own corpus before relying on them: rule quality and false-positive behaviour vary by author.