Researchers at AttackIQ have engineered an attack graph that emulates the complex tactics, techniques, and procedures (TTPs) recently deployed by the VanHelsing ransomware group, one of 2025’s fastest-growing threats.
This emulation framework is designed to enable security teams to rigorously validate their controls and incident response processes against a threat actor renowned for sophistication, agility, and a cross-platform offensive arsenal.
Innovative Emulation Frameworks
VanHelsing, which appeared on the threat landscape in March 2025, operates under a ransomware-as-a-service (RaaS) model.
It has rapidly gained notoriety for targeting diverse operating environments-including Windows, Linux, BSD, ARM-based devices, and VMware ESXi.
The Windows strain, specifically, is developed in C++, utilizing cryptographic primitives Curve25519 and ChaCha20 for payload encryption while appending a distinct “.vanhelsing” extension to affected files.
Its double-extortion methodology with data exfiltration preceding encryption and threats of public data leaks has positioned VanHelsing among the most disruptive ransomware operations globally.
To date, five confirmed victims have been identified across the US, France, Italy, and Australia, with data from three already exposed on a public shaming site.
The VanHelsing affiliate program mirrors traditional RaaS structures, requiring a $5,000 onboarding deposit and offering attackers an 80% share of ransom proceeds.
Affiliates are provided with an intuitive control panel for managing operations, tracking payments, and overseeing victim systems a feature set that further accelerates attack cycles and complexity.
AttackIQ’s latest attack graph derives from detailed behavioral analyses published by CheckPoint on March 23, 2025.
The simulation encapsulates the full spectrum of VanHelsing’s operational phases, starting with initial access and system reconnaissance and culminating in widespread file encryption and lateral movement.
VanHelsing’s Multi-Platform Ransomware Tactics
During initial compromise, the ransomware employs evasive maneuvers such as debugger detection through Windows API calls (IsDebuggerPresent) and meticulous locale verification via GetUserDefaultLCID, GetUserDefaultLocaleName, and GetLocaleInfoA.
These checks enable VanHelsing to bypass systems in unintended regions or to evade automated sandbox analyses.
System fingerprinting employs calls to GetEnvironmentStrings and GetNativeSystemInfo, collecting environmental variables often leveraged for privilege escalation or secret harvesting.
The second operational stage focuses on maximizing impact. VanHelsing disables recovery options by executing wmic shadowcopy delete commands, systematically removes Volume Shadow Copies, and pursues extensive directory and peripheral discovery using Windows APIs like GetLogicalDriveStringsW and GetDriveTypeW.
Network share identification and lateral movement are orchestrated through net share enumeration and network scanning for open SMB ports.
File system traversal is performed with FindFirstFileW and FindNextFileW routines, and ransomware payloads are executed as new processes via CreateProcessA.
Encryption of targeted file types is then completed using VanHelsing’s proprietary cryptographic approach.
According to the Report, AttackIQ’s emulation platform enables customers to not only observe but actively test and refine detection, prevention, and response pipelines against these behaviors.
Critical defensive opportunities highlighted include preempting tool ingress via network controls and vigilant monitoring for shadow copy deletions two high-leverage points in disrupting ransomware operations.
Recommendations align with MITRE ATT&CK mitigation strategies, emphasizing intrusion prevention, system backup rigor, and hardening user account management.
By deploying this advanced attack graph, organizations gain the ability to continuously audit and improve their readiness against a real-world, high-profile adversary.
AttackIQ’s commitment to adversarial emulation, grounded in its Adversarial Exposure Validation (AEV) platform and partnership with the MITRE Center for Threat Informed Defense, represents a vital step forward in proactive security validation amid an evolving ransomware landscape.
Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant updates
