Cybersecurity specialists have successfully replicated the advanced tactics and strategies employed by VanHelsing, a new and highly effective ransomware-as-a-service (RaaS) platform that emerged in March 2025 and has swiftly become a major threat in the cybercrime landscape.
VanHelsing operates using a double extortion model, locking down files with the Curve25519 and ChaCha20 encryption algorithms, while also stealing sensitive data and threatening to release it publicly unless a ransom is paid.
The ransomware appends the “.vanhelsing” extension to encrypted files and demands payment in Bitcoin. The ransom notes vary in their demands, based on the specific victim’s profile.
One of the most alarming features of VanHelsing is its ability to target multiple platforms, including Windows, Linux, BSD, ARM devices, and VMware ESXi systems.
The Windows variant of the ransomware is written in C++ and is equipped with advanced persistence and anti-detection techniques. The VanHelsing operation also runs a structured affiliate program, where newcomers are required to pay a $5,000 deposit, and affiliates retain 80% of the ransom payments they collect.
Affiliates are provided with access to a specialized control panel for managing attacks, tracking affected systems, and overseeing payment status.
Research from AttackIQ revealed that by May 14, 2025, VanHelsing had already compromised five organizations in the United States, France, Italy, and Australia, with data from three non-compliant victims being published on the ransomware’s leak site.
To aid organizations in defending against this growing threat, AttackIQ has published a detailed attack graph replicating the ransomware’s behavior, allowing security teams to test their defenses against this advanced attack model.
The attack typically begins with the ransomware being deployed onto compromised systems, followed by initial reconnaissance to gather system details and confirm that the target is suitable for infection.
VanHelsing performs extensive pre-encryption checks to avoid harming unintended targets, including those in certain geographical regions, and includes a variety of anti-analysis features designed to evade detection.
Advanced Evasion and Encryption Techniques
VanHelsing utilizes a range of evasion strategies to avoid detection and maintain stealth during its operations.
The malware checks for the presence of debuggers by utilizing the IsDebuggerPresent Windows API, and it also conducts system location checks using multiple APIs, such as GetUserDefaultLCID, GetUserDefaultLocaleName, and GetLocaleInfoA, to confirm the victim’s location.
Further analysis revealed that VanHelsing uses GetEnvironmentStrings and GetNativeSystemInfo to identify system characteristics and potentially locate stored credentials.
Before initiating encryption, VanHelsing disrupts recovery options by executing commands to remove Volume Shadow Copies with the command:
vssadmin Delete Shadows /All /Quiet
This behavior can be detected by monitoring specific command line activities:
- Process Name == (cmd.exe OR powershell.exe)
- Command Line CONTAINS (“vssadmin” AND “Delete Shadows”)
Once this preparatory phase is completed, the ransomware identifies and targets valuable files using system calls like FindFirstFileW and FindNextFileW.
Files are then encrypted with a combination of ChaCha20 symmetric encryption and Curve25519 ECDH encryption, making them inaccessible without the attacker’s private key.
VanHelsing Encryption Workflow (Source – AttackIQ)
Upon completing the encryption process, VanHelsing alters system settings by modifying the registry, resulting in the victim’s desktop wallpaper being replaced with the ransom message.
Given its advanced methods and expanding list of targets, cybersecurity experts are urged to prioritize testing their security measures against this evolving threat, utilizing the newly released emulation tools to assess and strengthen their defenses.
