Cross-Platform VanHelsing Ransomware Targets Windows, Linux and VMware ESXi

Researchers identified a new RaaS operation named VanHelsing (launched March 7) that advertises cross-platform support (Windows, Linux, VMware ESXi, BSD, Arm) and uses an affiliate model with a $5,000 deposit and an 80/20 revenue split; three organizations have already been targeted with $500,000 demands, though known infections to date are Windows-only. The program provides a control panel to simplify attacks for lower-skilled affiliates, is under active development with rapid updates and incomplete features, and explicitly forbids attacks in Russia and certain CIS countries.