Christoffer S.<p>(checkpoint.com) VanHelsingRaaS: Analysis of a New and Rapidly Expanding Ransomware-as-a-Service Program</p><p><a href="https://research.checkpoint.com/2025/vanhelsing-new-raas-in-town/" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">research.checkpoint.com/2025/v</span><span class="invisible">anhelsing-new-raas-in-town/</span></a></p><p>A few days ago (2025-03-20) Cyfirma published a short article and "analysis" of the VanHelsing RaaS and here comes a bit meatier one from CheckPoint.</p><p>VanHelsingRaaS is a new ransomware-as-a-service program launched on March 7, 2025, that has quickly gained traction in the cybercrime world. Within just two weeks of its introduction, it infected three victims and demanded large ransom payments. The service offers free access to reputable affiliates while new affiliates must pay a $5,000 deposit. Affiliates receive 80% of ransom payments, with 20% going to the RaaS operators. The ransomware targets multiple platforms including Windows, Linux, BSD, ARM, and ESXi systems, significantly expanding its attack surface. The program follows typical Russian cybercrime behavior by prohibiting encryption of systems in CIS countries.</p><p><a href="https://swecyb.com/tags/Cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Cybersecurity</span></a> <a href="https://swecyb.com/tags/ThreatIntel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ThreatIntel</span></a> <a href="https://swecyb.com/tags/Ransomware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Ransomware</span></a> <a href="https://swecyb.com/tags/VanHelsing" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>VanHelsing</span></a></p>