Ankura CTIX FLASH Update - November 22, 2024

Ransomware/Malware Activity

Helldown Ransomware Branches into VMware and Linux Systems

A relatively new ransomware group – Helldown – has been expanding its ransomware capabilities to target VMware ESXi environments and Linux systems. The Helldown ransomware strain was first identified by researchers in August 2024, targeting sectors including IT services, telecommunications, manufacturing, and healthcare. The group has attacked over thirty companies since it arrived on the scene just a few months ago. Helldown has been observed exploiting vulnerabilities in Zyxel firewall appliances to initially breach networks, stealing credentials and creating SSL VPN tunnels to maintain access. The Windows variant of the ransomware deletes shadow copies and terminates processes prior to encrypting files and self-destructing. The ransomware appears to be a variant of the leaked LockBit 3.0 ransomware, and its artifacts share similarities with ransomware group DarkRace or