helldown Ransomware
Tracked since Aug 13, 2024
0
victims recorded
0
in the last 30 days
0
CVEs
—
Last activity
Helldown is an aggressive ransomware group first documented in August 2024, known for exploiting Zyxel firewall vulnerabilities to gain initial access and conducting large-scale data exfiltration averaging 70 GB per victim, targeting IT services, telecommunications, manufacturing, and healthcare primarily in the US.
Vulnerabilities cited for this group
CVEs associated with the group by ransomware.live. Records not yet published here appear without a link.
No CVE associated with this group in the sources.
Observed tools
Credential Theft
Mimikatz
Defense Evasion
HRSword
Discovery Enum
Advanced Port Scanner
LOLBAS
PsExec
RMM-Tools
TeamViewer
Victims posted on leak sites, according to ransomware.live. Victim names are not displayed. · View on ransomware.live