Hellcat
| RaaS
HellCat is a ransomware-as-a-service group that formed in Q4 2024 and quickly became notable for high-profile attacks against Schneider Electric, Telefónica, and Israel's Knesset, primarily gaining initial access via stolen Jira credentials harvested by infostealer malware, targeting critical infrastructure and government entities.
Victims
20
First Victim
2024-10-25
(est. attack date)
Discovery Date
2024-10-25
Last Seen
2025-04-10
Inactive Since
1yr
more than
Avg Delay
4.5
days
Infostealer
80.0%
victims with domain
Countries
13
hit
Uptime
0.0% avg (30d)
Known Locations (7)
| Favicon | Title | Type | Available | Last Visit | Server Info | FQDN | Status | |
|---|---|---|---|---|---|---|---|---|
|
404 Not Found | No | 2026-08-22T08:04:58 |
hellcakbszllztlyqbjzwcbdhfrodx55wq77kmftp4bhnhsnn5r3odad.onion
|
||||
|
HellCat - Blog | No | 2026-08-22T08:06:47 |
hellcatdcy653ma43t2ryf2ztw5yfanqsbfmapndbqvteh5itctoijyd.onion
|
||||
|
HellCat - Blog | No | 2026-08-22T08:06:13 |
hellcatdnrsu4i5uctbklunpfyv2ppiioh5sb3leu4dfgizinrve3gqd.onion
|
||||
|
HellCat - Blog | No | 2026-08-22T08:06:30 |
hellcatdohzngkuh7zruzhi2wojrawbnzbyzljtkw6iluv5ussfer4id.onion
|
||||
|
HellCat - Blog | No | 2026-08-22T08:04:41 |
hellcatdue7rasyoi4oh6t3fhra5bpcj5t6xmrm4vjicfqdvrl24ijid.onion
|
||||
|
No | 2026-08-22T08:05:53 |
hellcatj6xgvho4qxnr2nbzzthsqel577i5wvzcpfjgavbo3d5l657id.onion
|
|||||
|
No | 2026-09-06T14:48:51 |
hcatxn4ppkgmakaatrq6bsbhqk5ouhviygyx57gljjt5iseul5nvpayd.onion
|
Target
Top 5 Activity Sectors
- Technology 9
- Education 3
- Financial Services 2
- Retail & E-Commerce 2
- Government & Defense 2
Top 5 Countries
-
United States
6
-
China
2
-
Poland
1
-
Sweden
1
-
Spain
1
Heatmap
Ransom Notes (2)
YARA Rules (1)
Indicators of Compromise (IoCs) (2)
Email
1
Tox
1
| Type | IOC |
|---|---|
Email
|
h3llr4ns@onionmail.com
|
Tox
|
F97D66EB390592BA053CC7C25C16ECDBE42F3C266DD2A99CB9D1DDABE69F6A41EF5FB3D9EE7F
|
Victims (20)
We have breached a U.S.-based financial services firm. 381GB of sensitive data has been secured. The…
Jiraware <<3 !! We hold sensitive data from HighWire Press, a leading platform serving scholarly pub…
We have compromised the internal systems of LeoVegas AB. The data in our possession threatens their …
We hold almost 70GB of sensitive data from Transsion, a leading mobile device provider with $8.6B in…
We hold sensitive files from Santillana, the largest business unit of Spain’s publicly traded Prisa …
We hold 19GB of sensitive files from Electronics For Imaging, Inc., including critical corporate dat…
44GB of sensitive data including internal reports, sales documents, confidential contracts, developm…
We have successfully stolen over50 GBof data from Car Care Plan, including financial records with se…
We have successfully stolen82 GBof data, including backups, from the e-Finance system of Blora Regen…
We have successfully breached Pinger, obtaining 111 GB of sensitive data. This includes over 9 milli…
We have released over 500,000 records from Tanzania’s College of Business Education, containing stud…
We have successfully accessed and compromised a range of sensitive documents from Jordan's Ministry …
[IA generated] Schneider Electric, based in France, is a global leader in energy management and auto…
We have successfully compromised the Knesset's secure networks and extracted 64GB of sensitive data.…