Helldown
Helldown is an aggressive ransomware group first documented in August 2024, known for exploiting Zyxel firewall vulnerabilities to gain initial access and conducting large-scale data exfiltration averaging 70 GB per victim, targeting IT services, telecommunications, manufacturing, and healthcare primarily in the US.
Victims
36
First Victim
2024-08-05
(est. attack date)
Discovery Date
2024-08-13
Last Seen
2024-11-06
Inactive Since
1yr
more than
Avg Delay
15.7
days
Infostealer
25.0%
victims with domain
Countries
17
hit
Uptime
0.0% avg (30d)
Known Locations (2)
| Favicon | Title | Type | Available | Last Visit | Server Info | FQDN | Status | |
|---|---|---|---|---|---|---|---|---|
|
Helldown Leaks | No | 2026-08-22T08:44:25 |
onyxcgfg4pjevvp5h34zvhaj45kbft3dg5r33j5vu3nyp7xic3vrzvad.onion
|
||||
|
Helldown Leaks | No | 2026-08-22T08:43:19 |
onyxcym4mjilrsptk5uo2dhesbwntuban55mvww2olk5ygqafhu3i3yd.onion
|
Target
Top 5 Activity Sectors
- Professional Services 9
- Healthcare 6
- Manufacturing 6
- Technology 5
- Energy & Utilities 3
Top 5 Countries
-
United States
9
-
Germany
4
-
Italy
3
-
Switzerland
2
-
France
2
Heatmap
Ransom Notes (1)
Tools Used
| Discovery | RMM Tools | Defense Evasion | Credential Theft | OffSec | Networking | LOLBAS | Exfiltration |
|---|---|---|---|---|---|---|---|
|
Advanced Port Scanner
|
TeamViewer
|
HRSword
|
Mimikatz
|
PsExec
|
YARA Rules (1)
Indicators of Compromise (IoCs) (2)
Email
1
Tox
1
| Type | IOC |
|---|---|
Email
|
helldown@onionmail.org
|
Tox
|
19A549A57160F384CF4E36EE1A24747ED99C623C48EA545F343296FB7092795D00875C94151E
|
Victims (36)
