THREAT ACTOR
HELLDOWN_
DormantHELLDOWN is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem: file encryption combined with the threat of stolen-data publication on a public leak site. It continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of HELLDOWN, including incident write-ups, attribution notes and additional context, see the Threat Groups archive or run a site search.
Victims by year
- 2024 32
Leak site mirrors
4 mirrors tracked, 0 currently reachable. These are criminal-infrastructure URLs; links are deliberately not provided.
-
onyxcgfg4pjevvp5h34zvhaj45kbft3dg5r33j5vu3nyp7xic3vrzvad.onionHelldown Leaks snapshot · 2024-08-25 04:06 -
onyxcym4mjilrsptk5uo2dhesbwntuban55mvww2olk5ygqafhu3i3yd.onionHelldown Leaks snapshot · 2024-11-21 13:10 -
www.helldown.orgParking Page snapshot · 2025-12-07 05:14 -
onyxcb44xvqra35m3lp3z26kf2pxrlbn64nbzvyvzjyc3uykzrwcjdid.onionsnapshot · 2024-12-11 10:07
Recent victims
The 50 most recent victims claimed by HELLDOWN. Total in the index: 32.
| Date listed | Victim | Description |
|---|---|---|
| 2024-11-06 | klinkamkurpark | klinik-am-kurpark.de |
| 2024-11-06 | hausdesstiftens.org | hausdesstiftens.org |
| 2024-11-06 | nightnurse.ch | www.nightnurse.ch |
| 2024-11-06 | fuelco | fuelco-us.com |
| 2024-11-06 | VALLEYFIRM | valleyfirm.com |
| 2024-11-06 | children | generaldentistryforchildren.com |
| 2024-11-06 | knoxlawcenter | www.knoxlawcenter.com |
| 2024-11-06 | AMERICANVENTURE | americanventures.com |
| 2024-11-06 | CSIKBS | www.csikitchenandbath.com |
| 2024-11-06 | SANJACINTOCOUNY | www.co.san-jacinto.tx.us |
| 2024-11-06 | compassfs | www.compassfs.net |
| 2024-11-06 | lacliniqueducoureur | lacliniqueducoureur.com |
| 2024-11-06 | TIVOLI-33 | tivoli-33.org |
| 2024-11-06 | qualiform.cz | www.qualiform.cz |
| 2024-11-06 | SMARTS-ENGINEER | www.smarts-engineering.de |
| 2024-08-24 | HBGJEWISHCOMMUN | www.jewishharrisburg.org |
| 2024-08-22 | cincinnatipainphysicians | www.cincinnatipainphysicians.com |
| 2024-08-22 | BARRYAVEPLATING | Here's something encrypted, password is required to continue reading. |
| 2024-08-22 | RSK-IMMOBILIEN | Here's something encrypted, password is required to continue reading. |
| 2024-08-19 | Khonaysser | Here's something encrypted, password is required to continue reading. |
| 2024-08-18 | kbo | Here's something encrypted, password is required to continue reading. |
| 2024-08-17 | zyxel | Zyxel.eu |
| 2024-08-14 | hugwi | hugwi.ch |
| 2024-08-13 | deganis | deganis.fr |
| 2024-08-13 | SCHLATTNER | SCHLATTNER.de |
| 2024-08-13 | XPERT | XPERT Business Solutions GmbH |
| 2024-08-13 | MyFreightWorld | MyFreightWorld |
| 2024-08-13 | cbmm | cbmm.org |
| 2024-08-13 | ATP | AZIENDA TRASPORTI PUBBLICI S.P.A. |
| 2024-08-13 | briju | briju.pl |
| 2024-08-13 | vindix | vindix.pl |
| 2024-08-13 | Albatros | Albatros S.r.l. |
CONFIRMED ATTACKS
Helldown confirmed attacks: 6 verified incidents
Ransomnews has verified 6 Helldown incidents against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. All of them fall in August 2024. Germany accounts for 2 of them (33%), with victims recorded in 3 countries in total. The most affected sector is other, at 2 confirmed victims. A ransom payment was publicly confirmed in 0 cases and publicly refused in 1; the outcome is unrecorded in the remaining 5. Where a figure was disclosed (1 case), these incidents account for 5,181 exposed records.
Confirmed victims by year
Most affected sectors
Most affected countries
Verified Helldown incidents
| Date | Organisation | Sector | Location | Records | Ransom paid | Source |
|---|---|---|---|---|---|---|
| August 2024 | Chesapeake Bay Maritime Museum | Other | Maryland, United States | 5,181 | Unknown | Source |
| August 2024 | Cincinnati Pain Physicians | Healthcare | Ohio, United States | — | No | Source |
| August 2024 | Haus des Stiftens GmbH | Other | Munich, Germany | — | Unknown | Source |
| August 2024 | Klinik am Kurpark | Healthcare | Bad Wildungen, Germany | — | Unknown | Source |
| August 2024 | Hug-Witschi AG | Finance | Murten, Switzerland | — | Unknown | Source |
| August 2024 | Schlatter Group | Manufacturing | Schlieren, Switzerland | — | Unknown | Source |
Claimed vs confirmed. The figures above the fold on this page come from Helldown's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design: most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.