New VanHelsing Ransomware Threatens Windows and Other Systems

1️⃣ VanHelsing is a new Ransomware-as-a-Service (RaaS) targeting Windows, ARM, and ESXi systems.

2️⃣ It uses double extortion, encrypting files and threatening to leak stolen data.

3️⃣ The RaaS model enables low-skilled attackers to easily launch ransomware campaigns.

4️⃣ Stay protected by updating systems, using strong security tools, and backing up data regularly.

Listen to the article:

In March 2025, a new multi-platform ransomware variant called VanHelsing was identified, operating as a ransomware-as-a-service (RaaS) model. This threat has raised significant concern due to its advanced techniques and widespread impact. Unlike typical malware, VanHelsing is part of the growing RaaS trend, which allows cybercriminals to launch attacks without requiring technical expertise. Let’s break down everything you need to know about VanHelsing ransomware and how to stay safe from it.

What Is VanHelsing Ransomware?

VanHelsing ransomware is a sophisticated and multi-platform threat that targets various systems, including Windows, Linux, ARM, and even VMware ESXi servers. The attackers behind this operation are not just after a quick ransom—they employ double-extortion tactics. This means that if victims don’t pay, their sensitive data will be leaked publicly, which can be even more damaging than the encryption itself.

RaaS Model: Easy Access for Cybercriminals

What makes VanHelsing even more dangerous is its RaaS model. Cybercriminals can pay a $5,000 deposit to become affiliates and launch their own attacks using the ransomware. These affiliates keep 80% of the ransom, with only 20% going to the ransomware developers. This model lowers the bar for aspiring hackers, meaning more attacks are likely in the future.

VanHelsing’s RaaS program even offers flexibility—experienced criminals can bypass the deposit requirement entirely. This has made it a popular choice among various threat actors looking to profit from cybercrime.

How VanHelsing Operates

Once VanHelsing infects a system, it encrypts files and appends the “.vanhelsing” extension, making it easy to identify. The ransomware then drops a ransom note on the infected system and alters the desktop wallpaper to inform the victim of the attack. Alongside the encryption, the attackers exfiltrate sensitive data and threaten to release it if the ransom isn’t paid.

Interestingly, VanHelsing uses advanced evasion techniques to avoid detection. This includes anti-debugging checks and the use of Windows Management Instrumentation (WMI) to run the ransomware covertly. It can also make itself persistent by modifying the system registry and setting up scheduled tasks to re-execute after a reboot.

Targeted Sectors and Geography

VanHelsing has shown a clear preference for high-value targets. So far, it has gone after organizations in government, pharmaceuticals, and manufacturing sectors in countries like the United States and France. Notably, the group’s operators have specifically avoided CIS countries, which indicates a Russian origin or affiliation.

Mitigating the Threat

If you want to protect your organization from VanHelsing and similar ransomware, here are some steps to take:

• Regular Backups: Ensure that you regularly back up your critical files, and store them offline to prevent encryption.
• Patch Management: Make sure all systems are up to date with the latest security patches to avoid vulnerabilities.
• Endpoint Protection: Deploy advanced endpoint security tools to detect suspicious activities early.
• Employee Awareness: Educate employees on how to recognize phishing emails and avoid unsafe links that could trigger infections.

Final Thoughts

As ransomware threats like VanHelsing continue to evolve, it’s important for individuals and organizations to stay vigilant. This particular ransomware is becoming a major threat, especially because of its RaaS model and advanced evasion tactics. By taking proactive steps to secure systems and educating staff, you can minimize the risk of falling victim to this and other ransomware attacks.

✅Checkpoint’s post of the in-depth analysis on how VanHelsing operates and the tactics used by the attackers.

✅Broadcom’s post of VanHelsing’s detection and protection strategies.

Image credit: Aliaksei – stock.adobe.com