New Vanhelsing Ransomware RaaS Model Emerges, Targeting Enterprises Globally

The cybersecurity landscape has witnessed the emergence of a new ransomware-as-a-service (RaaS) model known as Vanhelsing. This ransomware variant is rapidly gaining traction among cybercriminals due to its sophisticated attack mechanisms and extensive targeting of enterprises worldwide. Vanhelsing RaaS operates by providing affiliates with a ready-to-use ransomware toolkit, enabling them to launch attacks without deep technical expertise. The model's flexibility and profitability have made it a preferred choice for threat actors seeking to maximize their impact and financial gain. Vanhelsing ransomware employs advanced encryption algorithms to lock victims' data, demanding hefty ransoms for decryption keys. Its distribution methods include phishing campaigns, exploit kits, and compromised remote desktop protocols, making it a versatile threat. Organizations affected by Vanhelsing face significant operational disruptions and potential data breaches, emphasizing the need for robust cybersecurity measures. Security experts recommend implementing comprehensive defense strategies, including regular data backups, employee training on phishing awareness, and deploying advanced endpoint protection solutions. Additionally, monitoring network traffic for unusual activities and promptly applying security patches can mitigate the risk posed by Vanhelsing and similar ransomware threats. The rise of Vanhelsing RaaS underscores the evolving nature of ransomware threats and the importance of proactive cybersecurity practices. Enterprises must stay informed about emerging threats and continuously enhance their security posture to defend against sophisticated ransomware campaigns effectively.

This Cyber News was published on cybersecuritynews.com. Publication date: Tue, 11 Nov 2025 15:45:12 +0000


Cyber News related to New Vanhelsing Ransomware RaaS Model Emerges, Targeting Enterprises Globally

New VanHelsing ransomware targets Windows, ARM, ESXi systems - In normal encryption mode, VanHelsing enumerates files and folders, encrypts the file contents, and renames the resulting file appending the ‘.vanhelsing’ extension. Files stolen from the victims’ networks are stored directly on the ...
8 months ago Bleepingcomputer.com
New Vanhelsing Ransomware RaaS Model Emerges, Targeting Enterprises Globally - The cybersecurity landscape has witnessed the emergence of a new ransomware-as-a-service (RaaS) model known as Vanhelsing. This ransomware variant is rapidly gaining traction among cybercriminals due to its sophisticated attack mechanisms and ...
3 weeks ago Cybersecuritynews.com
10 Best Ransomware Protection Tools - 2025 - It protects devices from ransomware and other cyber threats using advanced threat intelligence, behavioral analysis, and cloud-based technology. It monitors and prevents ransomware assaults on personal files and automatically restores encrypted ...
9 months ago Cybersecuritynews.com
Researchers Emulated VanHelsing Ransomware Advanced Tactics & Tools Used - AttackIQ researchers identified that as of May 14, 2025, the VanHelsing operation had already infected five organizations across the United States, France, Italy, and Australia, with data from three non-compliant victims published on their leak site. ...
6 months ago Cybersecuritynews.com
10 Best Ransomware File Decryptor Tools in 2025 - Kaspersky Rakhni Decryptor contains different decryption tools based on various versions of Rakhni ransomware and helps you decrypt encrypted files on your system. PyLocky Ransomware Decryption Tool is a free and open source developed and released by ...
7 months ago Cybersecuritynews.com
VanHelsing Ransomware Attacking Windows Systems With New Evasion Technique & File Extension - A new ransomware strain named VanHelsing has emerged, targeting Windows systems with sophisticated encryption techniques and advanced evasion tactics. Cyfirma researchers discovered that VanHelsing employs a double extortion strategy, not only ...
8 months ago Cybersecuritynews.com
Rise in RaaS Operations and Implications for Business Security - Recently, there had been news regarding the cyber-attack in a Japanese port, that blocked the smooth transfer of goods - a hack in a Las Vegas resort which led to malfunction in slot machines and guest check-ins and a whopping $100 million loss, and ...
1 year ago Cysecurity.news
The Top 10 Ransomware Groups of 2023 - This article takes an in-depth look at the rise in ransomware attacks over the past year and the criminal groups driving the surge in cyber extortion. LockBit has established itself as one of the most notorious ransomware operations since emerging on ...
1 year ago Securityboulevard.com TA505 8base LockBit BianLian Medusa Noescape Black Basta
Hive Ransomware: A Detailed Analysis - This past week, on January 26th, to be exact, the FBI successfully shut down the Hive ransomware group and saved victims over a hundred million dollars in ransom payments and remediation costs. As ransomware continues to be a national security threat ...
2 years ago Heimdalsecurity.com LockBit
New VanHelsingRaaS Attacking Linux, BSD, ARM, and ESXi Systems - This two-stage approach helps evade behavioral detection systems that might flag simultaneous encryption and renaming activities as indicators of ransomware behavior. After all files have been encrypted in Silent mode, the ransomware performs a ...
8 months ago Cybersecuritynews.com
Cyber Insights 2023: Criminal Gangs - The result is more than a dozen features on subjects ranging from AI, quantum encryption, and attack surface management to venture capital, regulations, and criminal gangs. Despite some geopolitical overlaps with state attackers, the majority of ...
2 years ago Securityweek.com
Medusa Ransomware Turning Your Files into Stone - Unit 42 Threat Intelligence analysts have noticed an escalation in Medusa ransomware activities and a shift in tactics toward extortion, characterized by the introduction in early 2023 of their dedicated leak site called the Medusa Blog. The Unit 42 ...
1 year ago Unit42.paloaltonetworks.com Medusa
Ransomware Roundup - The Ransomware Roundup report aims to provide readers with brief insights into the evolving ransomware landscape and the Fortinet solutions that protect against those variants. This edition of the Ransomware Roundup covers the 8base ransomware. 8base ...
1 year ago Feeds.fortinet.com 8base
Targeting homeowners' data - As these companies obtain a large amount of sensitive information from their customers, they become attractive targets for ransomware gangs to conduct double-extortion attacks. Finland is also warning of Akira ransomware increasingly targeting ...
1 year ago Bleepingcomputer.com LockBit Akira
Cisco Talos Report: New Trends in Ransomware, Network Infrastructure Attacks, Commodity Loader Malware - The Cisco Talos Year in Review report released Tuesday highlights new trends in the cybersecurity threat landscape. We'll focus on three topics covered: the ransomware cybercriminal ecosystem, network infrastructure attacks and commodity loader ...
1 year ago Techrepublic.com LockBit
Waiting for the BlackCat rebrand - We saw another ransomware operation shut down this week after first getting breached by law enforcement and then targeting critical infrastructure, putting them further in the spotlight of the US government. While the Tor onion domain seizure was a ...
1 year ago Bleepingcomputer.com Medusa Cuba STORMOUS
Declining Ransomware Payments: Shift in Hacker Tactics? - Several cybersecurity advisories and agencies recommend not caving into ransomware gangs' demands and paying their ransoms. It seems the tide is turning, with a decline in ransomware payments; this article explores the trend and what it might mean ...
1 year ago Securityboulevard.com
New 'Gentlemen's' RaaS Advertised on Hacking Forums - A new ransomware-as-a-service (RaaS) called 'Gentlemen's' has been spotted being advertised on various hacking forums. This emerging RaaS offering is gaining attention due to its unique approach and features that appeal to cybercriminals seeking to ...
1 month ago Cybersecuritynews.com
Ransomware trends and recovery strategies companies should know - Ransomware attacks can have severe consequences, causing financial losses, reputational damage, and operational disruptions. The methods used to deliver ransomware vary, including phishing emails, malicious websites, and exploiting vulnerabilities in ...
1 year ago Helpnetsecurity.com
Key Group uses leaked builders of ransomware and wipers | Securelist - The first discovered sample of Key Group, the Xorist ransomware, established persistence in the system by changing file extension associations. The .huis_bn extension added to encrypted files in the early versions of Key Group samples, Xorist and ...
1 year ago Securelist.com
Ransomware in 2023 recap: 5 key takeaways - This provides the best overall picture of ransomware activity, but the true number of attacks is far higher. While some ransomware trends hardly changed over the last year, such as LockBit's continued dominance, ransomware criminals also challenged ...
1 year ago Malwarebytes.com Scattered Spider LockBit
The Week in Ransomware - Attacks on hospitals continued this week, with ransomware operations disrupting patient care as they force organization to respond to cyberattacks. While many, like LockBit, claim to have policies in place to avoid encryping hospitals, we continue to ...
1 year ago Bleepingcomputer.com LockBit Cactus
The Week in Ransomware - Governments struck back this week against members of ransomware operations, imposing sanctions on one threat actor and sentencing another to prison. On Tuesday, the Australian, US, and UK governments announced sanctions against Aleksandr Gennadievich ...
1 year ago Bleepingcomputer.com LockBit BianLian Akira Cactus
The Week in Ransomware - Earlier this month, the BlackCat/ALPHV ransomware operation suffered a five-day disruption to their Tor data leak and negotiation sites, rumored to be caused by a law enforcement action. The FBI revealed this week that they hacked the BlackCat/ALPHV ...
1 year ago Bleepingcomputer.com LockBit Akira Noescape
Ransomware Mastermind Uncovered After Oversharing on Dark Web - When researchers responded to an ad to join up with a ransomware-as-a-service operation, they wound up in a cybercriminal job interview with one of the most active threat actors in the affiliate business, who turns out to be behind at least five ...
2 years ago Darkreading.com