Ransomware.live: Helix

| Active

None

Victims

First Victim

2026-08-07

(est. attack date)

Discovery Date

2026-08-07

Last Seen

2026-10-21

Inactive Since

days

Avg Delay

N/A

attack→claim

Infostealer

100.0%

victims with domain

Countries

hit

Uptime

59.0% avg (30d)

View Victims on World Map View Group Statistics

Attack Velocity — Last 12 months (based on attack estimated date if available)

Known Locations (3)

Title	Available	Last Visit	Server Info	FQDN
HELIX	Yes	2026-11-06T18:44:47	BaseHTTP 0.6 Python 3.11.2	`helixr2sncrd3ndsz5oho6mzqw3x5u7mvox5zcsngc5wm7v4l5k7oryd.onion`
HELIX - Leaks	Yes	2026-11-06T18:45:35	BaseHTTP 0.6 Python 3.11.2	`helixr2sncrd3ndsz5oho6mzqw3x5u7mvox5zcsngc5wm7v4l5k7oryd.onion/leaks`
	No	2026-11-06T18:46:00		`helix2kvkqjzrkh3ospyukij7uemxwvbdmqberjmrudjmqy4hspwzzqd.onion`

Target

Heatmap

Indicators of Compromise (IoCs) (2)

PGP 2

Type IOC

Type	IOC
`PGP`	-----BEGIN PGP PUBLIC KEY BLOCK----- mDMEalfxCRYJKwYBBAHaRw8BAQdAkQU88BrSUxCKytiFyQPZtafmUzKp2Inf9MI9 BJG4wHK0BUhlbGl4iLUEExYKAF0WIQTRDW4AqkpkvAPoO9P+kq6Sd3DgIQUCalfx CRsUgAAAAAAEAA5tYW51MiwyLjUrMS4xMiwyLDECGwMFCQWkqXcFCwkIBwICIgIG FQoJCAsCBBYCAwECHgcCF4AACgkQ/pKukndw4CHt/gD/Rh5JBoxFUaVUsdRHPCjG LAHlZMfvY9HMAXkQHXS/ZYIBAOtcL8BDSMbsaF2g80RI2kkYwhsy5hl7OSnBb5qN lVgMuDgEalfxCRIKKwYBBAGXVQEFAQEHQGvV38s68tdBwVd8QGGT6F6iN4Ow1uhU 1sZdQO4UUekYAwEIB4iaBBgWCgBCFiEE0Q1uAKpKZLwD6DvT/pKukndw4CEFAmpX 8QkbFIAAAAAABAAObWFudTIsMi41KzEuMTIsMiwxAhsMBQkFpKl3AAoJEP6SrpJ3 cOAhwO8BAI1sZwDOfUDmpiW3vN2f8AJBlVp9+H0RWe49FbXvEhfQAQCEly9hKO9R SUm42JpJy77PMt3o/AUPs2w2z+nGSCAfAQ== =ZBDz -----END PGP PUBLIC KEY BLOCK-----
`PGP`	-----BEGIN PGP PUBLIC KEY BLOCK----- mDMEalfxCRYJKwYBBAHaRw8BAQdAkQU88BrSUxCKytiFyQPZtafmUzKp2Inf9MI9 BJG4wHK0BUhlbGl4iLUEExYKAF0WIQTRDW4AqkpkvAPoO9P+kq6Sd3DgIQUCalfx CRsUgAAAAAAEAA5tYW51MiwyLjUrMS4xMiwyLDECGwMFCQWkqXcFCwkIBwICIgIG FQoJCAsCBBYCAwECHgcCF4AACgkQ/pKukndw4CHt/gD/Rh5JBoxFUaVUsdRHPCjG LAHlZMfvY9HMAXkQHXS/ZYIBAOtcL8BDSMbsaF2g80RI2kkYwhsy5hl7OSnBb5qN lVgMuDgEalfxCRIKKwYBBAGXVQEFAQEHQGvV38s68tdBwVd8QGGT6F6iN4Ow1uhU 1sZdQO4UUekYAwEIB4iaBBgWCgBCFiEE0Q1uAKpKZLwD6DvT/pKukndw4CEFAmpX 8QkbFIAAAAAABAAObWFudTIsMi41KzEuMTIsMiwxAhsMBQkFpKl3AAoJEP6SrpJ3 cOAhwO8BAI1sZwDOfUDmpiW3vN2f8AJBlVp9+H0RWe49FbXvEhfQAQCEly9hKO9R SUm42JpJy77PMt3o/AUPs2w2z+nGSCAfAQ== =ZBDz -----END PGP PUBLIC KEY BLOCK-----

PGP

PGP

Victims (17)

Westrock Coffee

Helix

Discovered: 2026-10-21 (16d ago)

Westrock Coffee records. Yearly revenue ~$1.2 billion yearly. GoFile links and passwords unlock in 2…

Hypertherm

Helix

Discovered: 2026-10-21 (16d ago)

Hypertherm records. Yearly revenue ~$650.7 million yearly. GoFile links and passwords unlock in 24 h…

American Campus

Helix

Discovered: 2026-10-19 (18d ago)

American Campus records. Yearly revenue ~$1 billion yearly. GoFile links and passwords unlock in 6 h…

Southwire

Helix

Discovered: 2026-10-18 (19d ago)

Southwire records. Yearly revenue ~$9 billion. GoFile links and passwords unlock in 6 hours.…

Quikrete

Helix

Discovered: 2026-10-18 (19d ago)

Quikrete records. GoFile links and passwords unlock in 6 hours.…

Personify Health

Helix

Discovered: 2026-10-17 (19d ago)

Personify Health records. Yearly revenue ~$500 million. GoFile links and passwords unlock in 12 hour…

Bay Alarm

Helix

Discovered: 2026-10-17 (19d ago)

Bay Alarm records. Yearly revenue ~$256 million. GoFile links and passwords unlock in 12 hours.…

Smith Douglas Homes

Helix

Discovered: 2026-10-17 (19d ago)

Smith Douglas Homes records. Yearly revenue ~$971 million. GoFile links and passwords unlock in 12 h…

Rheem Global

Helix

Discovered: 2026-10-17 (20d ago)

Rheem Global customer records. Yearly revenue ~$6 billion. GoFile links and passwords unlock in 12 h…

AmSpec

Helix

Discovered: 2026-08-22 (2mo ago)

AmSpec is live. T1 unlocks on the current 24-hour cadence, then 24 hours per remaining tier.…

Delek US

Helix

Discovered: 2026-08-19 (2mo ago)

Delek US is live. T1 unlocks in 12 hours, then 24 hours per remaining tier.…

Kennedy Jenks

Helix

Discovered: 2026-08-16 (2mo ago)

Kennedy Jenks is live. T1 is unlocked. T2 in 24 hours, then one day each through T4.…

Venture Logistics

Helix