Draft:Helldown-Ransomware

Helldown is a newly emerging ransomware strain that targets Windows, Linux, and VMware systems. First identified in August 2024 by cybersecurity firm Halcyon, the ransomware group behind Helldown has been described as an aggressive cybercrime group exploiting vulnerabilities to infiltrate networks and execute attacks using double extortion tactics.

Helldown is notable for extending its reach into virtualized environments by targeting popular infrastructure like VMware ESXi, marking a significant evolution in ransomware targeting methods.

Discovery and Documentation

Helldown was first documented by cybersecurity firm Halcyon in August 2024. The firm highlighted Helldown as an aggressive threat actor exploiting vulnerabilities in appliances and software to infiltrate targeted networks. The sectors known to be attacked by Helldown include:

• IT Services
• Telecommunications
• Manufacturing
• Healthcare

Helldown’s reliance on the leaked LockBit 3.0 source code suggests a broader trend in which the leak has led to a proliferation of new ransomware variants.

Technical Characteristics

Helldown has distinct versions for Windows and Linux, each tailored to maximize disruption to its targets.

Windows Version

The Windows version of Helldown follows a multi-step approach to encryption:

1. Initial Access and Persistence:

   Helldown exploits vulnerabilities in internet-facing devices, particularly Zyxel firewalls, to gain an initial foothold in networks.

2. Credential Harvesting and Network Enumeration:

   After gaining access, Helldown harvests credentials to navigate through the network and locate high-value targets.

3. Process Termination and Shadow Copy Deletion:

   The ransomware terminates processes related to databases and office applications to unlock files, and deletes system shadow copies to prevent file recovery.

4. Encryption and Cleanup:

   Once files are encrypted, a ransom note is created to demand payment, and the binary deletes itself to make forensic analysis more difficult.

Linux Version

The Linux version of Helldown appears to be less advanced compared to the Windows variant, lacking obfuscation and anti-debugging mechanisms:

• The ransomware is capable of listing and killing active virtual machines (VMs) prior to encryption, which allows it to gain write access to VM image files.
• It primarily focuses on encrypting files and exhibits no network communication or use of public key encryption, leading researchers to question how decryption is managed by the attackers.

These observations suggest that the Linux variant of Helldown is still in development and not as sophisticated as other contemporary ransomware strains.

Attack Chains and Methods

Helldown utilizes multiple techniques to infiltrate and expand within the target network:

• Exploiting known and unknown vulnerabilities in Zyxel firewalls to gain initial access.
• Establishing persistent connections via SSL VPN tunnels created with temporary users.
• Carrying out activities such as:
  • Credential harvesting
  • Network enumeration
  • Lateral movement and defense evasion

The use of persistent tunnels and lateral movement allows Helldown to maximize its impact once inside the network.

Relationship with Other Ransomware

Helldown's codebase and operational methods are heavily inspired by LockBit 3.0. According to Sekoia, Helldown shares significant similarities with two other ransomware variants:

• DarkRace: First surfaced in May 2023.
• DoNex: Rebranded from DarkRace and continued using LockBit 3.0 code. A decryptor for DoNex was released by Avast in July 2024.

Though there is significant overlap, it is not definitively confirmed that Helldown is a rebrand of DarkRace or DoNex.

Double Extortion Tactics

Similar to many modern ransomware operations, Helldown employs double extortion tactics, threatening to publish stolen data if the victim fails to pay the demanded ransom. This approach puts added pressure on victims, as the prospect of both data loss and reputational damage can be significant.

Comparisons to Other Emerging Ransomware

The emergence of Helldown coincides with other ransomware families such as Interlock and SafePay:

• Interlock targets healthcare, technology, and government sectors in the United States, as well as manufacturing entities in Europe.
• SafePay has claimed responsibility for attacks on 22 companies and also uses the LockBit 3.0 code for its encryption routines.

These new ransomware strains illustrate a broader trend of cybercriminal groups leveraging leaked source code to develop more diverse and adaptable threats.

Impact and Threat

Helldown’s evolution into virtualized environments marks an important shift in ransomware strategies. By targeting virtualized infrastructure such as VMware ESXi systems, Helldown seeks to disrupt business operations on a larger scale. Its reliance on vulnerabilities in firewalls and its lack of certain advanced features indicate that it is still under development but nevertheless poses a substantial threat to organizations lacking proper cybersecurity measures.

The use of LockBit 3.0's code has highlighted the importance of vigilance regarding leaked source codes, as multiple threat actors appear to be capitalizing on these leaks to launch similar attacks. Organizations are advised to address vulnerabilities, enhance perimeter defenses, and employ proactive monitoring to defend against these ransomware threats.

See Also

• Ransomware
• LockBit
• Cybersecurity
• Double Extortion