Operator dossier

VanHelsing is a ransomware operator no longer publishing new disclosures. Darkfield has indexed 8 public victims claimed by this operator between March 17, 2025 and April 5, 2025. VanHelsing is a recently emerged ransomware group first observed in March 2025, appearing to be financially motivated based on their targeting patterns and operational characteristics. Given their recent emergence and limited public documentation, details about their specific country of origin and affiliations remain unclear, though their targeting of multiple Western nations suggests they may operate from outside these jurisdictions. The group has demonstrated a preference for high-value sectors including healthcare, technology, and financial services, with attacks spanning the United States, Australia, Chile, France, and Italy, though their specific attack vectors and technical methodologies have not been extensively documented by major security firms or government agencies. With only eight known victims since their March 2025 emergence, VanHelsing appears to be a smaller-scale operation that may be conducting targeted attacks rather than broad spray-and-pray campaigns. The group remains active as of current reporting, though the limited public intelligence available suggests they have not yet achieved the notoriety or scale of more established ransomware operations.

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Inactive ransomware operator

← All groups

VanHelsing

8 victims indexed · first seen 1 year ago · last activity 1 year ago

Victims indexed

#221 of 364 tracked operators

Active period

Mar 2025 → Apr 2025

Countries hit

top US · 3

At a glance

Status: inactive
First seen: 1 year ago
Last activity: 1 year ago
Onion sites: 4 known endpoints
Primary sector: Healthcare · 2 hits

About

VanHelsing is a recently emerged ransomware group first observed in March 2025, appearing to be financially motivated based on their targeting patterns and operational characteristics. Given their recent emergence and limited public documentation, details about their specific country of origin and affiliations remain unclear, though their targeting of multiple Western nations suggests they may operate from outside these jurisdictions. The group has demonstrated a preference for high-value sectors including healthcare, technology, and financial services, with attacks spanning the United States, Australia, Chile, France, and Italy, though their specific attack vectors and technical methodologies have not been extensively documented by major security firms or government agencies. With only eight known victims since their March 2025 emergence, VanHelsing appears to be a smaller-scale operation that may be conducting targeted attacks rather than broad spray-and-pray campaigns. The group remains active as of current reporting, though the limited public intelligence available suggests they have not yet achieved the notoriety or scale of more established ransomware operations.

References

2 links

External sources curated by the MISP threat-intel community.

Timeline

2 months

2025-03-01T00:00:00+00:002025-04-01T00:00:00+00:00

Top countries

🇺🇸 United States

🇦🇺 Australia

🇨🇱 Chile

🇫🇷 France

🇮🇹 Italy

United States dossier →Australia dossier →Chile dossier →France dossier →

Top sectors

Healthcare

Technology

Business Services

Financial Services

Public Sector

Healthcare dossier →Technology dossier →Business Services dossier →Financial Services dossier →

MITRE ATT&CK

3 techniques · 3 tactics

Tactics

Initial AccessExecutionImpact

Techniques

T1566Phishing
T1059Command and Scripting Interpreter
T1486Data Encrypted for Impact

Recent victims

Loading…

Onion infrastructure

4 known

http://vanhelqmjstkvlhrjwzgjzpq422iku6wlggiz5y5r3rmfdeiaj3ljaid.onion
http://vanhelvuuo4k3xsiq626zkqvp6kobc2abry5wowxqysibmqs5yjh4uqd.onion/blog
http://vanhelwmbf2bwzw7gmseg36qqm4ekc5uuhqbsew4eihzcahyq7sukzad.onion/blog
http://vanhelxjo52qr2ixcmtjayqqrcodkuh36n7uq7q7xj23ggotyr3y72yd.onion/blog

Source

Updated 1 year ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time VanHelsing posts a victim.

Add VanHelsing to your watchlist — Pro pings you within 5 minutes of any new VanHelsing leak-site post, Telegram callout, or affiliate-rebrand inference.