Full Report
A new multi-platform ransomware-as-a-service (RaaS) operation named VanHelsing has emerged, targeting Windows, Linux, BSD, ARM, and ESXi systems. [...]
Analysis Summary
# Tool/Technique: VanHelsing Ransomware
## Overview
VanHelsing is a newly observed ransomware strain written in C++, designed to target Windows, ARM, and ESXi systems. It employs sophisticated encryption techniques and offers customizable command-line options, including a "stealth mode" intended to evade security detection.
## Technical Details
- Type: Malware family (Ransomware)
- Platform: Windows, ARM, ESXi
- Capabilities: File encryption (ChaCha20), customizable CLI, volume shadow copy skipping, SMB spreading capabilities, and a two-phase stealth mode.
- First Seen: Evidence suggests deployment in the wild started around March 16 (Year not specified in context, assuming recent based on "New" designation).
## MITRE ATT&CK Mapping
*Note: Direct mappings are inferred based on ransomware behavior described.*
- **TA0011 - Command and Control** (Potential for C2 communication implied by deployment and customization)
- T1071 - Application Layer Protocol (If standard network protocols are used for C2 or exfiltration)
- **TA0005 - Defense Evasion**
- T1027 - Obfuscated Files or Information (Stealth mode aims to evade detection based on I/O patterns)
- **TA0010 - Exfiltration** (Double extortion implied by threatening to leak stolen files)
- **TA0040 - Impact**
- T1486 - Data Encrypted for Impact
- T1490 - Inhibit System Recovery (Skipping deletion of shadow copies is mentioned, implying other system recovery methods might be targeted)
## Functionality
### Core Capabilities
- **Encryption:** Uses the ChaCha20 algorithm to encrypt file contents.
- **Key Management:** Generates a 32-byte (256-bit) symmetric key and a 12-byte nonce per file, which are then encrypted using an embedded Curve25519 public key. The encrypted key/nonce pair is appended to the file.
- **Targeting:** Encrypts files smaller than 1GB completely; partially encrypts files larger than 1GB.
- **File Renaming:** Appends the `.vanhelsing` extension to encrypted files in normal mode.
### Advanced Features
- **Stealth Mode:** Decouples file encryption from file renaming. This masks the I/O pattern, making it resemble normal system behavior and delaying security tool reactions until encryption is complete.
- **Customizable CLI:** Allows operators to specify target drives/folders, restrict encryption scope, enable SMB spreading, skip shadow copy deletion, and configure the two-phase stealth mode.
- **Double Extortion:** Threatens to leak stolen data if the $500,000 ransom demand is not met.
## Indicators of Compromise
- File Hashes: [Not provided in context]
- File Names: Files renamed with the `.vanhelsing` extension.
- Registry Keys: [Not provided in context]
- Network Indicators: [Not provided in context]
- Behavioral Indicators: File I/O patterns that suddenly resemble normal system behavior (due to stealth mode decoupling rename from encryption), rapid file renaming.
## Associated Threat Actors
- [Not explicitly named in context, but associated with an operation demanding $500,000.]
## Detection Methods
- Signature-based detection: Detection based on signatures for the binary executable.
- Behavioral detection: Monitoring for processes that heavily utilize file encryption algorithms (ChaCha20) or exhibit unusual file/metadata manipulation patterns, especially if decoupled from standard renaming sequences.
- YARA rules: [Not provided in context]
## Mitigation Strategies
- **Backup and Recovery:** Maintain robust, offsite, immutable backups for recovery.
- **Endpoint Protection:** Deploy security solutions capable of detecting advanced file encryption behaviors, even when obfuscated by stealth techniques.
- **Access Control:** Limit lateral movement capabilities by segmenting networks and enforcing strict SMB access controls.
- **Patching/Configuration:** While not explicitly mentioned, ensuring up-to-date systems reduces the initial exploitation vector.
## Related Tools/Techniques
- Other ransomware families using ChaCha20 or Curve25519 for encryption.
- Ransomware strains employing multi-stage or stealth operations to evade behavioral analysis.