Vanhelsing ransomware

Who Vanhelsing is

VanHelsing is a multi-platform RaaS operation that launched on March 7, 2025, requiring a $5,000 affiliate deposit and splitting ransoms 80/20, supporting Windows, Linux, BSD, ARM, and ESXi targets, reaching at least five victims across the US, France, Italy, and Australia within its first two months.

Recorded activity

Disclosures attributed to Vanhelsing in this database run from March 2025 to April 2025, totalling 8 victims — 0% of everything tracked here. Vanhelsing has listed victims in 5 countries in this database, most often United States, followed by Chile and Italy. The sectors appearing most in its listings are Technology, Business Services, Healthcare.

Indicators of compromise

• 3e063dc0de937df5841cb9c2ff3e4651
• 5c254d25751269892b6f02d6c6384aef
• 5b28a0fc21ba079b380effb30e853132
• d7ad18e63064ef80cc6b98db54516f6f
• 97150d47ea7779101be6582fc329c2cd
• 084deb26cd9d8eff3f972e8e0c4adfe6
• 193.37.69.225
• 193.37.69.162

Showing a sample of 7 MD5, 2 IP on file. Hashes and network indicators published for Vanhelsing. Leak-site addresses are deliberately excluded. Indicators age quickly — treat a match as a starting point for investigation, and an absence of matches as no assurance.

YARA detection rules

/*
VanHelsing ransomware-as-a-service
*/

rule VanHelsing_Ransomnote
{
    meta:
        author = "ransomware.live"
        family = "ransomware.vanhelsing"
        description = "Detects VanHelsing ransomware ransom note"
        date = "2026-05-04"
        severity = 7
        score = 70

    strings:
        $s1 = "VanHelsing" ascii nocase
        $s2 = "VANHELSING" ascii
        $s3 = "vanhelsing.onion" ascii nocase
        $s4 = ".vanhelsing" ascii

    condition:
        any of them
}

Community-contributed rules for Vanhelsing, reproduced as published. Test them against your own corpus before relying on them: rule quality and false-positive behaviour vary by author.