VanHelsing

VanHelsing is a ransomware-as-a-service (RaaS) operation attributed to Russian cybercriminals. The ransomware encrypts victim files and demands payment for decryption, employing double extortion tactics. The threat actors prohibit targeting Commonwealth of Independent States (CIS) countries, a characteristic behavior of Russian cybercrime groups. The malware creates a global mutex to prevent multiple instances from running simultaneously.