HellCat is a ransomware-as-a-service group targeting critical infrastructure using stolen Jira credentials.
HellCat is a ransomware-as-a-service group that emerged in late 2024. They primarily target critical infrastructure and government entities. Their main TTP involves gaining initial access via stolen Jira credentials harvested by infostealer malware. Defenders should prioritize monitoring for corporate credential leaks and detecting infostealer infections early.
HellCat is a ransomware-as-a-service group that formed in Q4 2024 and quickly became notable for high-profile attacks against Schneider Electric, Telefónica, and Israel's Knesset, primarily gaining initial access via stolen Jira credentials harvested by infostealer malware, targeting critical infrastructure and government entities.
HellCat uses stolen Jira credentials harvested by infostealer malware for initial access.
Defenders should strengthen monitoring for corporate credential leaks and focus on early detection of infostealer infections.
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.