Helldown

Helldown, a malware intrusion set that first surfaced in August 2024, is causing significant concern in the cybersecurity community. Initially known for targeting Windows systems, the Helldown group has expanded its operations to include VMware ESX servers and Linux environments. According to a report by Sekoia’s Threat Detection & Research (TDR) team, the malware operates using a double-extortion model, frequently exploiting vulnerabilities in Zyxel firewalls to gain initial access. The recent discovery of a Linux variant suggests that Helldown is diversifying its targets, intensifying the threat it poses. The behavior of Helldown is similar to Darkrace, a LockBit variant that appeared in August 2023, which may have been rebranded as Donex earlier this year. Although the links between these ransomware strains are not conclusive, Sekoia posits that Helldown could be a rebrand of Donex. The malware typically targets data sources storing administrative files containing sensitive information, thereby increasing the pressure on victims. Analysis of the files published on Helldown's data leak site reveals them to be unusually large, averaging around 70GB. In terms of attack tactics, Helldown actors are likely accessing victim environments directly from their Internet-facing Zyxel firewall, particularly those running firmware version 5.38. They use legitimate tools and other living-off-the-land techniques to execute their mission on compromised networks. Furthermore, they exhibit a penchant for stealing large volumes of data from victims and threatening to leak the data unless a ransom is paid. This focus on VMware systems indicates an evolution in Helldown operators' strategy to disrupt virtualized infrastructures that many businesses rely on, marking a troubling shift in ransomware actor tactics.