hellcat
First seen October 25, 2024Active20 claimed victims
The claims below are reproduced as posted by hellcat on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
HellCat is a ransomware-as-a-service group that formed in Q4 2024 and quickly became notable for high-profile attacks against Schneider Electric, Telefónica, and Israel's Knesset, primarily gaining initial access via stolen Jira credentials harvested by infostealer malware, targeting critical infrastructure and government entities.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| CVTE | April 7, 2025 | ransomware_live | — |
| P**o*** | April 7, 2025 | ransomware_live | — |
| Potomac Financial Services | April 7, 2025 | ransomware_live | — |
| LeoVegas AB | April 5, 2025 | ransomware_live | — |
| Asseco | April 5, 2025 | ransomware_live | — |
| Racami | April 5, 2025 | ransomware_live | — |
| Transsion Holdings | March 29, 2025 | ransomware_live | — |
| Omnitracs | March 24, 2025 | ransomware_live | — |
| Grupo Santillana | March 24, 2025 | ransomware_live | — |
| HighWire Press | March 18, 2025 | ransomware_live | — |
| Electronics For Imaging | March 17, 2025 | ransomware_live | — |
| Ascom Holding AG | March 15, 2025 | ransomware_live | — |
| OneDealer | February 25, 2025 | ransomware_live | — |
| Car Care Plan - Turkey | December 26, 2024 | ransomware_live | — |
| Pinger - USA | December 25, 2024 | ransomware_live | — |
| Sistem Informasi Pengelolaan Keuangan Daerah (SIPKD) | December 25, 2024 | ransomware_live | — |
| Schneider Electric - France | November 4, 2024 | ransomware_live | — |
| Ministry of Education - Jordan | November 4, 2024 | ransomware_live | — |
| College of Business - Tanzania | November 4, 2024 | ransomware_live | — |
| The Knesset - Israel | October 25, 2024 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).