Helldown ransomware exploits Zyxel VPN flaw to breach networks

Helldown is an emerging ransomware operation reported by Sekoia that appears to exploit Zyxel firewall vulnerabilities (suspected CVE-2024-42057 and the later-tracked CVE-2024-11667) to establish VPN access (using accounts like 'OKSDW82A' and config 'zzz1.conf'), move laterally, exfiltrate large amounts of data and deploy Windows and Linux/MIPS encryptors; the group has listed multiple victims on an extortion site and published large data dumps, while some evidence suggests use of leaked builders and private n-day exploits.