Ransomware group profile · #221 by claimed victims

VanHelsing ransomware

VanHelsing is a multi-platform RaaS operation that launched on March 7, 2025, requiring a $5,000 affiliate deposit and splitting ransoms 80/20, supporting Windows, Linux, BSD, ARM, and ESXi targets, reaching at least five victims across the US, France, Italy, and Australia within its first two months.

Active First seen Mar 2025 .vanhelsing, .vanlocker

8Victims claimed on leak sites

0Victims in the last 30 days

0Victims in the last 90 days

5Countries hit

10Leak-site URLs tracked, 0 online

5 Apr 2025Latest claim recorded

Victimology

Who VanHelsing claims to have breached, from 8 leak-site posts recorded by VULONE.

Claims per month last 12 months

Top sectors

Technology2

Professional Services2

Healthcare2

Financial Services1

Government & Defense1

Top countries

United States4

Chile1

Australia1

Italy1

France1

Latest claimed victims 8 most recent

Victim	Sector	Country	Claimed
caschile.cl caschile.cl	Financial Services	CL	5 Apr 2025
attorneykohm.com attorneykohm.com	Professional Services	US	31 Mar 2025
alertenterprise.com alertenterprise.com	Technology	US	31 Mar 2025
compumedics.com.au AND neuromedicalsupplies.com compumedics.com.au	Healthcare	AU	26 Mar 2025
studiocdlvallone.it studiocdlvallone.it	Professional Services	IT	24 Mar 2025
www.medsrx.com medsrx.com	Healthcare	US	19 Mar 2025
Atos-racks.com atos-racks.com	Technology	FR	18 Mar 2025
www.cityofbellville.com cityofbellville.com	Government & Defense	US	17 Mar 2025

All 8 VanHelsing victims, searchable

Full victim list with claim posts, domains, timing and exports, plus the negotiation chats and leak-site screenshots VULONE archives for this crew.

Start free Sign in

Tactics, techniques and procedures

ATT&CK technique mapping for VanHelsing is in progress. Victimology, infrastructure status and leak-site tracking are live above.

Indicators, detections and the full playbook

Hashes, C2 addresses, onion services, Sigma and YARA detections per technique, and the negotiation transcripts are available to signed-in analysts.

See full IOCs

Frequently asked

Is VanHelsing ransomware still active?

VanHelsing is tracked as active. The most recent leak-site claim VULONE recorded is dated 5 April 2025.

How many victims has VanHelsing claimed?

VULONE has recorded 8 leak-site victim claims attributed to VanHelsing since March 2025, across 5 countries and 5 sectors.

Which industries does VanHelsing target?

The sectors most often named on the VanHelsing leak site are Technology, Professional Services, Healthcare.

Which countries are most affected by VanHelsing?

Most VanHelsing victims recorded by VULONE are located in United States, Chile, Australia.

Where does VULONE get VanHelsing victim data?

Claims are collected continuously from the group's own leak sites and cross-checked with ransomware.live and RansomLook. A claim is the group's assertion, not a confirmed breach.

Other ransomware groups

Victim claims are collected from leak sites and enrichment partners (ransomware.live, RansomLook) and represent the group's own assertions, not confirmed breaches. Profile last updated 16 September 2026. Questions or corrections: [email protected].