Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Enjoying ransomware.live? Help us keep tracking ransomware gangs and shipping new features. Support us

Helix / Unc7761

New Group | Active

This is an emerging group, so claims should be treated with caution until independently verified.
None

Victims
8
 
First Victim
2026-08-07
(est. attack date)
Discovery Date
2026-08-07
 
Last Seen
2026-08-22
 
Inactive Since
10
days
Avg Delay
N/A
attack→claim
Infostealer
100.0%
victims with domain
Countries
2
hit
Uptime
65.6% avg (30d)
View Victims on World Map View Group Statistics
Attack Velocity — Last 12 months (based on attack estimated date if available)
Known Locations (3)
Favicon Title Type Available Last Visit Server Info FQDN Status
favicon HELIX Yes 2026-09-01T14:53:36 helix helixr2sncrd3ndsz5oho6mzqw3x5u7mvox5zcsngc5wm7v4l5k7oryd.onion
favicon HELIX - Leaks Yes 2026-09-01T14:54:38 helix helixr2sncrd3ndsz5oho6mzqw3x5u7mvox5zcsngc5wm7v4l5k7oryd.onion/leaks
favicon No 2026-09-01T14:53:01 NGINX nginx helix2kvkqjzrkh3ospyukij7uemxwvbdmqberjmrudjmqy4hspwzzqd.onion
Target
Top 5 Activity Sectors
  • Energy & Utilities 2
  • Transportation 2
  • Professional Services 1
  • Other 1
  • Financial Services 1
Top 5 Countries
  • US flag United States 6
  • CA flag Canada 1
Heatmap
Indicators of Compromise (IoCs) (1)
Certificate 1
Type IOC
Certificate 
-----BEGIN PGP PUBLIC KEY BLOCK-----
mDMEalfxCRYJKwYBBAHaRw8BAQdAkQU88BrSUxCKytiFyQPZtafmUzKp2Inf9MI9
BJG4wHK0BUhlbGl4iLUEExYKAF0WIQTRDW4AqkpkvAPoO9P+kq6Sd3DgIQUCalfx
CRsUgAAAAAAEAA5tYW51MiwyLjUrMS4xMiwyLDECGwMFCQWkqXcFCwkIBwICIgIG
FQoJCAsCBBYCAwECHgcCF4AACgkQ/pKukndw4CHt/gD/Rh5JBoxFUaVUsdRHPCjG
LAHlZMfvY9HMAXkQHXS/ZYIBAOtcL8BDSMbsaF2g80RI2kkYwhsy5hl7OSnBb5qN
lVgMuDgEalfxCRIKKwYBBAGXVQEFAQEHQGvV38s68tdBwVd8QGGT6F6iN4Ow1uhU
1sZdQO4UUekYAwEIB4iaBBgWCgBCFiEE0Q1uAKpKZLwD6DvT/pKukndw4CEFAmpX
8QkbFIAAAAAABAAObWFudTIsMi41KzEuMTIsMiwxAhsMBQkFpKl3AAoJEP6SrpJ3
cOAhwO8BAI1sZwDOfUDmpiW3vN2f8AJBlVp9+H0RWe49FbXvEhfQAQCEly9hKO9R
SUm42JpJy77PMt3o/AUPs2w2z+nGSCAfAQ==
=ZBDz
-----END PGP PUBLIC KEY BLOCK-----
Victims (8)
Logo
AmSpec US
Helix
Discovered: 2026-08-22 (9d ago)
AmSpec is live. T1 unlocks on the current 24-hour cadence, then 24 hours per remaining tier.…
Logo
Delek US US
Helix
Discovered: 2026-08-19 (12d ago)
Delek US is live. T1 unlocks in 12 hours, then 24 hours per remaining tier.…
Logo
Kennedy Jenks US
Helix
Discovered: 2026-08-16 (16d ago)
Kennedy Jenks is live. T1 is unlocked. T2 in 24 hours, then one day each through T4.…
Logo
Venture Logistics
Helix
Discovered: 2026-08-07 (25d ago)
SharePoint libraries staged T1 (least) → T4 (most). Release countdown live on Helix. Tiers unlock by…
Logo
Uber US
Helix
Discovered: 2026-08-07 (25d ago)
SharePoint libraries staged T1 (least) → T4 (most). Release countdown live on Helix. Tiers unlock by…
Logo
Highwoods Properties US
Helix
Discovered: 2026-08-07 (25d ago)
SharePoint libraries staged T1 (least) → T4 (most). Release countdown live on Helix. Tiers unlock by…
Logo
Morguard US
Helix
Discovered: 2026-08-07 (25d ago)
Morguard reached out, took extensions, then ignored the negotiation with no real offer. Contacting …
Logo
Westland Insurance CA
Helix
Discovered: 2026-08-07 (25d ago)
Westland reached out, got the full demand, then stalled with no serious number. Contacting us and d…