A sophisticated new ransomware-as-a-service (RaaS) operation called VanHelsing has surfaced in the cybercrime landscape, targeting multiple platforms including Windows, Linux, BSD, ARM, and ESXi systems.
## Operation Details
First promoted on underground forums on March 7, VanHelsing offers experienced affiliates free entry while requiring a $5,000 deposit from less experienced actors. The Russian-based operation prohibits targeting systems in Commonwealth of Independent States (CIS) countries.
The profit-sharing model allows affiliates to keep 80% of ransom payments, with operators taking 20%. Payments are processed through an automated escrow system using blockchain confirmations for security.
## Current Victims
VanHelsing’s dark web extortion portal currently lists three victims: a Texas city and two technology companies (two in the U.S. and one in France). The operators are demanding $500,000 in ransom payments and threatening to leak stolen data if demands aren’t met.
## Technical Capabilities
The C++ ransomware, first deployed on March 16, employs several advanced features:
– ChaCha20 algorithm for file encryption
– 256-bit symmetric key generation with 12-byte nonce for each file
– Curve25519 public key encryption for key/nonce pairs
– Partial encryption for files larger than 1GB
– Customizable CLI options for tailored attacks
– Two-phase stealth mode that separates encryption from file renaming
The stealth mode is particularly concerning as it mimics normal system behavior during encryption, making detection difficult. Even if security tools detect the activity during the renaming phase, files will have already been encrypted.
## Development Status
Despite its sophisticated design, Check Point researchers identified several flaws indicating code immaturity, including:
– File extension mismatches
– Errors in exclusion list logic that may cause double encryption
– Several unimplemented command-line flags
Despite these issues, VanHelsing represents a significant emerging threat that could gain substantial traction in the cybercriminal ecosystem.