Helldown
Helldown is an aggressive ransomware group first documented in August 2024, known for exploiting Zyxel firewall vulnerabilities to gain initial access and conducting large-scale data exfiltration averaging 70 GB per victim, targeting IT services, telecommunications, manufacturing, and healthcare primarily in the US.
Victims
36
First Discovered
2024-08-13
victim
Last Discovered
2024-11-06
victim
Inactive Since
1yr
more than
Avg Delay
15.7
days
Infostealer
11.1%
victims with domain
Countries
17
hit
Known Locations (2)
| Favicon | Title | Type | Available | Last Visit | Server Info | FQDN | |
|---|---|---|---|---|---|---|---|
|
Helldown Leaks | No | 2026-04-28T07:24:04 |
onyxcgfg4pjevvp5h34zvhaj45kbft3dg5r33j5vu3nyp7xic3vrzvad.onion
|
|||
|
Helldown Leaks | No | 2026-04-28T07:26:40 |
onyxcym4mjilrsptk5uo2dhesbwntuban55mvww2olk5ygqafhu3i3yd.onion
|
Target
Top 5 Activity Sectors
- Business Services 9
- Healthcare 6
- Manufacturing 4
- Energy 3
- Consumer Services 3
Top 5 Countries
-
United States
9
-
Germany
4
-
Italy
3
-
Switzerland
2
-
France
2
Heatmap
Ransom Notes (1)
Tools Used
| Discovery | RMM Tools | Defense Evasion | Credential Theft | OffSec | Networking | LOLBAS | Exfiltration |
|---|---|---|---|---|---|---|---|
|
Advanced Port Scanner
|
TeamViewer
|
HRSword
|
Mimikatz
|
PsExec
|
YARA Rules (1)
Indicators of Compromise (IoCs) (2)
Email
1
tox
1
| Type | IOC |
|---|---|
Email
|
helldown@onionmail.org
|
tox
|
19A549A57160F384CF4E36EE1A24747ED99C623C48EA545F343296FB7092795D00875C94151E
|
Victims (36)
