Ransomware Group
Helldown
Helldown is an aggressive ransomware group first documented in August 2024, known for exploiting Zyxel firewall vulnerabilities to gain initial access and conducting large-scale data exfiltration averaging 70 GB per victim, targeting IT services, telecommunications, manufacturing, and healthcare primarily in the US.
Known victims36
Threat level
MEDIUM
Get an alert if one of your domains is named on a ransomware leak site.
Monitor your domainsFree account · up to 5 monitored targets
Tactics, Techniques & Procedures (TTPs)
CredentialTheft
- Mimikatz
DefenseEvasion
- HRSword
DiscoveryEnum
- Advanced Port Scanner
LOLBAS
- PsExec
RMM-Tools
- TeamViewer
Known infrastructure
The following Tor hidden services have been associated with this group:
Helldown LeaksHelldown Leaks
These sites are malicious. Open them only from an isolated environment.
Check if you’re affected
Look up your domain to see whether it appears on Helldown’s victim list.
Try it nowFree⌘K
Try
risk score · threat categories · sources · age · confidence — in one request