Cato CTRL Threat Research: Unmasking Hellcat – Not Your Average Ransomware Gang

**Executive Summary:** Hellcat is a newly observed RaaS ransomware gang active in late 2024 that conducts double-extortion attacks and data leaks against government, education, and energy sectors; the report documents several incidents (including Schneider Electric with ~40GB exfiltrated and multiple root-access sales), describes TTPs such as zero-day exploitation and privilege escalation, and recommends defenses using the Cato SASE security stack.