Skip to main content
Darkfield

Operator dossier

Hellcat is a ransomware operator no longer publishing new disclosures. Darkfield has indexed 20 public victims claimed by this operator between October 25, 2024 and April 10, 2025. Hellcat is a recently emerged ransomware group first observed in October 2024, operating with apparent financial motivations based on their targeting patterns across multiple high-value sectors. The group's origin and potential state affiliations remain unclear due to their recent emergence, though their broad geographic targeting spanning the United States, China, Germany, France, and Israel suggests either a sophisticated international operation or the use of ransomware-as-a-service infrastructure. Limited public documentation exists regarding Hellcat's specific attack methodologies, encryption techniques, or whether they employ double extortion tactics involving data exfiltration prior to encryption, as major cybersecurity firms and government agencies have yet to publish detailed technical analyses of their operations. With only 20 documented victims to date, the group has not yet conducted any widely publicized major campaigns or drawn significant law enforcement attention, though their targeting of technology, education, government, and business services sectors indicates a focus on organizations likely to possess valuable data and have strong incentives to pay ransoms. Hellcat remains active as of current reporting, though their limited operational footprint and recent emergence make long-term assessment of their capabilities and persistence difficult to determine.

Most-targeted sectors

Most-affected countries

Recent disclosures by Hellcat

All 20 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for Hellcat →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Inactive ransomware operator

← All groups

Hellcat

20 victims indexed · first seen 2 years ago · last activity 1 year ago

20
Victims indexed
#161 of 364 tracked operators
6m
Active period
Oct 2024 → Apr 2025
10
Countries hit
top United States · 6

At a glance

Status
inactive
First seen
2 years ago
Last activity
1 year ago
Onion sites
1 known endpoint
Primary sector
Technology · 8 hits

About

Hellcat is a recently emerged ransomware group first observed in October 2024, operating with apparent financial motivations based on their targeting patterns across multiple high-value sectors. The group's origin and potential state affiliations remain unclear due to their recent emergence, though their broad geographic targeting spanning the United States, China, Germany, France, and Israel suggests either a sophisticated international operation or the use of ransomware-as-a-service infrastructure. Limited public documentation exists regarding Hellcat's specific attack methodologies, encryption techniques, or whether they employ double extortion tactics involving data exfiltration prior to encryption, as major cybersecurity firms and government agencies have yet to publish detailed technical analyses of their operations. With only 20 documented victims to date, the group has not yet conducted any widely publicized major campaigns or drawn significant law enforcement attention, though their targeting of technology, education, government, and business services sectors indicates a focus on organizations likely to possess valuable data and have strong incentives to pay ransoms. Hellcat remains active as of current reporting, though their limited operational footprint and recent emergence make long-term assessment of their capabilities and persistence difficult to determine.

References

4 links

External sources curated by the MISP threat-intel community.

Timeline

6 months
2024-10-01T00:00:00+00:00 · 12024-11-01T00:00:00+00:00 · 32024-12-01T00:00:00+00:00 · 32025-02-01T00:00:00+00:00 · 12025-03-01T00:00:00+00:00 · 52025-04-01T00:00:00+00:00 · 7
2024-10-01T00:00:00+00:002025-04-01T00:00:00+00:00

Top countries

🇺🇸 United States
6
🇨🇳 China
2
🇩🇪 Germany
1
🇫🇷 France
1
🇮🇱 Israel
1
🇹🇷 Turkey
1
🇨🇭 Switzerland
1
Tanzania
1
United States dossier →China dossier →Germany dossier →France dossier →

Top sectors

Technology
8
Education
3
Government
2
Business Services
1
Telecommunication
1
Financial
1
Energy
1
Financial Services
1
Technology dossier →Education dossier →Government dossier →Business Services dossier →

MITRE ATT&CK

4 techniques · 4 tactics

Tactics

Initial AccessExecutionDefense EvasionImpact

Techniques

  • T1566Phishing
  • T1059Command and Scripting Interpreter
  • T1027Obfuscated Files or Information
  • T1486Data Encrypted for Impact

Recent victims

Loading…

Onion infrastructure

1 known
  • http://hellcakbszllztlyqbjzwcbdhfrodx55wq77kmftp4bhnhsnn5r3odad.onion

Source

Updated 1 year ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time Hellcat posts a victim.

Add Hellcat to your watchlist — Pro pings you within 5 minutes of any new Hellcat leak-site post, Telegram callout, or affiliate-rebrand inference.