VanHelsing is a multi-platform Ransomware-as-a-Service (RaaS) operation active since March 2025.
VanHelsing is a multi-platform Ransomware-as-a-Service (RaaS) operation that launched in March 2025. It targets Windows, Linux, BSD, ARM, and ESXi systems, reaching victims in the US, France, Italy, and Australia within its first two months. The group operates an affiliate program requiring a $5,000 deposit with an 80/20 ransom split, demonstrating a professional crimeware model. Defenders should focus on hardening ESXi and Linux-based critical infrastructure given the group's cross-platform capabilities and rapid targeting pace.
VanHelsing is a multi-platform RaaS operation that launched on March 7, 2025, requiring a $5,000 affiliate deposit and splitting ransoms 80/20, supporting Windows, Linux, BSD, ARM, and ESXi targets, reaching at least five victims across the US, France, Italy, and Australia within its first two months.
VanHelsing operates through an affiliate program that requires a $5,000 deposit and splits the ransom payments at an 80/20 ratio.
VanHelsing has multi-platform targeting capabilities, specifically going after ESXi, Linux, BSD, ARM, and Windows systems, putting ESXi and Linux-based critical infrastructure at risk.
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.