Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Enjoying ransomware.live? Help us keep tracking ransomware gangs and shipping new features. Support us

Helix / Unc7761

New Group | Active

This is an emerging group, so claims should be treated with caution until independently verified.
None

Victims
5
 
First Discovered
2026-08-07
victim
Last Discovered
2026-08-07
victim
Inactive Since
1
day
Avg Delay
N/A
attack→claim
Infostealer
100.0%
victims with domain
Countries
2
hit
View Victims on World Map View Group Statistics
Attack Velocity — Last 12 months
5 victims this month
Known Locations (3)
Favicon Title Type Available Last Visit Server Info FQDN
favicon HELIX Yes 2026-08-08T17:21:03 helix helixr2sncrd3ndsz5oho6mzqw3x5u7mvox5zcsngc5wm7v4l5k7oryd.onion
favicon HELIX - Leaks Yes 2026-08-08T17:20:17 helix helixr2sncrd3ndsz5oho6mzqw3x5u7mvox5zcsngc5wm7v4l5k7oryd.onion/leaks
favicon No 2026-08-08T17:21:23 NGINX nginx helix2kvkqjzrkh3ospyukij7uemxwvbdmqberjmrudjmqy4hspwzzqd.onion
Target
Top 5 Activity Sectors
  • Transportation 2
  • Other 1
  • Financial Services 1
Top 5 Countries
  • US flag United States 3
  • CA flag Canada 1
Heatmap
Indicators of Compromise (IoCs) (1)
Certificate 1
Type IOC
Certificate 
-----BEGIN PGP PUBLIC KEY BLOCK-----
mDMEalfxCRYJKwYBBAHaRw8BAQdAkQU88BrSUxCKytiFyQPZtafmUzKp2Inf9MI9
BJG4wHK0BUhlbGl4iLUEExYKAF0WIQTRDW4AqkpkvAPoO9P+kq6Sd3DgIQUCalfx
CRsUgAAAAAAEAA5tYW51MiwyLjUrMS4xMiwyLDECGwMFCQWkqXcFCwkIBwICIgIG
FQoJCAsCBBYCAwECHgcCF4AACgkQ/pKukndw4CHt/gD/Rh5JBoxFUaVUsdRHPCjG
LAHlZMfvY9HMAXkQHXS/ZYIBAOtcL8BDSMbsaF2g80RI2kkYwhsy5hl7OSnBb5qN
lVgMuDgEalfxCRIKKwYBBAGXVQEFAQEHQGvV38s68tdBwVd8QGGT6F6iN4Ow1uhU
1sZdQO4UUekYAwEIB4iaBBgWCgBCFiEE0Q1uAKpKZLwD6DvT/pKukndw4CEFAmpX
8QkbFIAAAAAABAAObWFudTIsMi41KzEuMTIsMiwxAhsMBQkFpKl3AAoJEP6SrpJ3
cOAhwO8BAI1sZwDOfUDmpiW3vN2f8AJBlVp9+H0RWe49FbXvEhfQAQCEly9hKO9R
SUm42JpJy77PMt3o/AUPs2w2z+nGSCAfAQ==
=ZBDz
-----END PGP PUBLIC KEY BLOCK-----
Victims (5)
Logo
Venture Logistics
Helix
Discovered: 2026-08-07 (Yesterday)
SharePoint libraries staged T1 (least) → T4 (most). Release countdown live on Helix. Tiers unlock by…
Logo
Uber US
Helix
Discovered: 2026-08-07 (Yesterday)
SharePoint libraries staged T1 (least) → T4 (most). Release countdown live on Helix. Tiers unlock by…
Logo
Highwoods Properties US
Helix
Discovered: 2026-08-07 (Yesterday)
SharePoint libraries staged T1 (least) → T4 (most). Release countdown live on Helix. Tiers unlock by…
Logo
Morguard US
Helix
Discovered: 2026-08-07 (Yesterday)
Morguard reached out, took extensions, then ignored the negotiation with no real offer. Contacting …
Logo
Westland Insurance CA
Helix
Discovered: 2026-08-07 (Yesterday)
Westland reached out, got the full demand, then stalled with no serious number. Contacting us and d…