Ransomware Group:  
Hellcat



Sponsored by Hudson RockUse Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are impacting your business


Sites | Ransom Note(s) | Activity | Worldmap | Victims (20)


Sites

Favicon Title Type Available Last Visit FQDN Screenshot
HellCat - Blog 🟢 2025-04-16 00:02:10.140050 hellcakbszllztlyqbjzwcbdhfrodx55wq77kmftp4bhnhsnn5r3odad.onion 📸
🟢 2025-04-15 23:31:16.292006 hellcakbszllztlyqbjzwcbdhfrodx55wq77kmftp4bhnhsnn5r3odad.onion 📸

Ransom Note(s)

Activity over time

Worldmap

20 Victims

US flag

Potomac Financial Services 

Company logo
Ransomware Group:

Discovery Date: 2025-04-10 02:52
Estimated Attack Date: 2025-04-07

We have breached a U.S.-based financial services firm. 381GB of sensitive data has been secured. The name will be made public in a few hours. This is a warning.

Victim:   |  Group: 
 flag

P**o*** 

Company logo
Ransomware Group:

Discovery Date: 2025-04-07 19:02

Sector: Not Found
We have breached a U.S.-based financial services firm. 381GB of sensitive data has been secured. The name will be made public in a few hours. This is a warning.

Victim:   |  Group: 
CN flag

CVTE 

Company logo
Ransomware Group:

Discovery Date: 2025-04-07 19:02

Sector: Technology
We have breached the internal systems of Guangzhou Shiyuan Electronic Technology, securing sensitive files that, if exposed, would cause serious disruption across operations and partnerships.

Victim:   |  Group: 
US flag

HighWire Press 

Company logo
Ransomware Group:

Discovery Date: 2025-04-05 10:47
Estimated Attack Date: 2025-03-18

Sector: Technology
Jiraware <<3 !! We hold sensitive data from HighWire Press, a leading platform serving scholarly publishers. The data includes internal documents, communications, and materials that could impact both HighWire and its publishing partners.

HighWire Press has been previously claimed by Babuk2 for an attack estimated on 2025-03-18.

This could suggest a new attack, a cross-claim between brands by the same threat actor, or the recycling of previously leaked stolen data.

Update Date: 2025-04-05

Victim:   |  Group: 
US flag

Racami 

Company logo
Ransomware Group:

Discovery Date: 2025-04-05 10:47

Sector: Technology
Jiraware <<3 !! We have breached Racami’s internal systems. The data in our possession poses a serious threat to their business continuity, reputation, and client trust.

Victim:   |  Group: 
PL flag

Asseco 

Company logo
Ransomware Group:

Discovery Date: 2025-04-05 10:46

Sector: Technology
Jiraware <<3 !! We have breached Asseco’s internal systems, stealing sensitive files, communications, financial records, and source material

Victim:   |  Group: 
SE flag

LeoVegas AB 

Company logo
Ransomware Group:

Discovery Date: 2025-04-05 10:46

We have compromised the internal systems of LeoVegas AB. The data in our possession threatens their operations, regulatory compliance, and customer trust.

Victim:   |  Group: 
CN flag

Transsion Holdings 

Company logo
Ransomware Group:

Discovery Date: 2025-03-29 04:20

Sector: Technology
We hold almost 70GB of sensitive data from Transsion, a leading mobile device provider with $8.6B in revenue. This includes emails, internal communications, source codes, project planning, and data from Transsion and its partners.

Victim:   |  Group: 
ES flag

Grupo Santillana 

Company logo
Ransomware Group:

Discovery Date: 2025-03-25 00:29
Estimated Attack Date: 2025-03-24

Sector: Education
We hold sensitive files from Santillana, the largest business unit of Spain’s publicly traded Prisa media group. The company must act quickly to prevent the exposure of this data.

Victim:   |  Group: 
US flag

Omnitracs 

Company logo
Ransomware Group:

Discovery Date: 2025-03-25 00:28
Estimated Attack Date: 2025-03-24

Sector: Technology
We hold sensitive files from Omnitracs, a leading provider of fleet management and logistics solutions. The company must act swiftly to prevent the exposure of this data.

Victim:   |  Group: 
US flag

Electronics For Imaging 

Company logo
Ransomware Group:

Discovery Date: 2025-03-17 21:57

Sector: Technology
We hold 19GB of sensitive files from Electronics For Imaging, Inc., including critical corporate data that could jeopardize the company's operations, client relationships, and reputation if released publicly.

Victim:   |  Group: 
CH flag

Ascom Holding AG 

Company logo
Ransomware Group:

Discovery Date: 2025-03-16 00:02
Estimated Attack Date: 2025-03-15

Sector: Technology
44GB of sensitive data including internal reports, sales documents, confidential contracts, development tools, and source code stolen from Ascom.

Victim:   |  Group: 
DE flag

OneDealer 

Company logo
Ransomware Group:

Discovery Date: 2025-02-28 15:20
Estimated Attack Date: 2025-02-25

Sector: Not Found
We have obtained over 330,000 records from OneDealer partners, including sales reports, leads, customer data, and vehicle details with VINs and license plates. Affected companies include AutoHellas, AutoBesikos, KosmoCar, AWT, Karenta AE, QA, Proaxia, Hyundai, BMW, Audi, Kia,

Victim:   |  Group: 
TR flag

Car Care Plan - Turkey 

Company logo
Ransomware Group:

Discovery Date: 2024-12-26 00:47

Sector: Financial
We have successfully stolen over50 GBof data from Car Care Plan, including financial records with sensitive information, legal documents and statements, customer records, along with internal documents and records. All the data has been encrypted, and without our decryption key, it is almost impossible to decrypt.To ensure the return of this data, we are demanding a ransom of0.5 BTC. The deadline for this payment is fast approaching. Once the payment is received, the decryption key will be provided, and the data will be returned without delay. It is up to Car Care Plan to act accordingly.

Victim:   |  Group: 
ID flag

Sistem Informasi Pengelolaan Keuangan Daerah (SIPKD) 

Company logo
Ransomware Group:

Discovery Date: 2024-12-25 13:10

Sector: Government
We have successfully stolen82 GBof data, including backups, from the e-Finance system of Blora Regency, known as theSistem Informasi Pengelolaan Keuangan Daerah (SIPKD). The data spans from 2018 to the present and remains in our possession. To ensure its safe return, we are demanding1.5 BTC. The deadline for this payment is fast approaching. Once the payment is received, the data will be returned without further delay. The terms are clear, and it is up to Blora Regency's authorities to act accordingly.

Victim:   |  Group: 
US flag

Pinger - USA 

Company logo
Ransomware Group:

Discovery Date: 2024-12-25 13:10

We have successfully breached Pinger, obtaining 111 GB of sensitive data. This includes over 9 million user records, private messages, voice messages, internal tools such as phone number lookup and notification sender, backend systems, and source codes. Since the ransom was not paid, all the data has been publicly released.

Victim:   |  Group: 
TZ flag

College of Business - Tanzania 

Company logo
Ransomware Group:

Discovery Date: 2024-11-04 15:24

Sector: Education
We have released over 500,000 records from Tanzania’s College of Business Education, containing student names, phone numbers, emails, and additional data, including possible billing information.

Victim:   |  Group: 
JO flag

Ministry of Education - Jordan 

Company logo
Ransomware Group:

Discovery Date: 2024-11-04 15:24

Sector: Education
We have successfully accessed and compromised a range of sensitive documents from Jordan's Ministry of Education. This includes images of identification cards, divorce papers, and various letters addressed to the Minister.

Victim:   |  Group: 
FR flag

Schneider Electric - France 

Company logo
Ransomware Group:

Discovery Date: 2024-11-04 15:24

Sector: Energy
[IA generated] Schneider Electric, based in France, is a global leader in energy management and automation. The company focuses on digital transformation by integrating world-leading process and energy technologies. It provides solutions for homes, buildings, data centers, infrastructure, and industries, enhancing efficiency and sustainability. Schneider Electric emphasizes innovation and sustainability in its offerings.

Victim:   |  Group: 
IL flag

The Knesset - Israel 

Company logo
Ransomware Group:

Discovery Date: 2024-10-25 08:53

Sector: Government
We have successfully compromised the Knesset's secure networks and extracted 64GB of sensitive data. This includes internal communications and confidential documents.

Victim:   |  Group: