// THREAT ACTOR
HELLDOWN_
DormantHELLDOWN is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem — file encryption combined with the threat of stolen-data publication on a public leak site — and continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of HELLDOWN — incident write-ups, attribution notes, and additional context — see the Threat Groups archive or run a site search.
Victims by year
- 2024 32
Leak site mirrors
4 mirrors tracked, 0 currently reachable. These are criminal-infrastructure URLs — links are deliberately not provided.
-
onyxcgfg4pjevvp5h34zvhaj45kbft3dg5r33j5vu3nyp7xic3vrzvad.onionHelldown Leaks snapshot · 2024-08-25 04:06 -
onyxcym4mjilrsptk5uo2dhesbwntuban55mvww2olk5ygqafhu3i3yd.onionHelldown Leaks snapshot · 2024-11-21 13:10 -
www.helldown.orgParking Page snapshot · 2025-12-07 05:14 -
onyxcb44xvqra35m3lp3z26kf2pxrlbn64nbzvyvzjyc3uykzrwcjdid.onionsnapshot · 2024-12-11 10:07
Recent victims
The 50 most recent victims claimed by HELLDOWN. Total in the index: 32.
| Date listed | Victim | Description |
|---|---|---|
| 2024-11-06 | klinkamkurpark | klinik-am-kurpark.de |
| 2024-11-06 | hausdesstiftens.org | hausdesstiftens.org |
| 2024-11-06 | nightnurse.ch | www.nightnurse.ch |
| 2024-11-06 | fuelco | fuelco-us.com |
| 2024-11-06 | VALLEYFIRM | valleyfirm.com |
| 2024-11-06 | children | generaldentistryforchildren.com |
| 2024-11-06 | knoxlawcenter | www.knoxlawcenter.com |
| 2024-11-06 | AMERICANVENTURE | americanventures.com |
| 2024-11-06 | CSIKBS | www.csikitchenandbath.com |
| 2024-11-06 | SANJACINTOCOUNY | www.co.san-jacinto.tx.us |
| 2024-11-06 | compassfs | www.compassfs.net |
| 2024-11-06 | lacliniqueducoureur | lacliniqueducoureur.com |
| 2024-11-06 | TIVOLI-33 | tivoli-33.org |
| 2024-11-06 | qualiform.cz | www.qualiform.cz |
| 2024-11-06 | SMARTS-ENGINEER | www.smarts-engineering.de |
| 2024-08-24 | HBGJEWISHCOMMUN | www.jewishharrisburg.org |
| 2024-08-22 | cincinnatipainphysicians | www.cincinnatipainphysicians.com |
| 2024-08-22 | BARRYAVEPLATING | Here's something encrypted, password is required to continue reading. |
| 2024-08-22 | RSK-IMMOBILIEN | Here's something encrypted, password is required to continue reading. |
| 2024-08-19 | Khonaysser | Here's something encrypted, password is required to continue reading. |
| 2024-08-18 | kbo | Here's something encrypted, password is required to continue reading. |
| 2024-08-17 | zyxel | Zyxel.eu |
| 2024-08-14 | hugwi | hugwi.ch |
| 2024-08-13 | deganis | deganis.fr |
| 2024-08-13 | SCHLATTNER | SCHLATTNER.de |
| 2024-08-13 | XPERT | XPERT Business Solutions GmbH |
| 2024-08-13 | MyFreightWorld | MyFreightWorld |
| 2024-08-13 | cbmm | cbmm.org |
| 2024-08-13 | ATP | AZIENDA TRASPORTI PUBBLICI S.P.A. |
| 2024-08-13 | briju | briju.pl |
| 2024-08-13 | vindix | vindix.pl |
| 2024-08-13 | Albatros | Albatros S.r.l. |