Overview • Resumen • Architecture • IOCs • Analysis • MITRE ATT&CK • Full Report (EN) • Reporte Completo (ES)
Warning
FOR CYBERSECURITY RESEARCH AND EDUCATIONAL PURPOSES ONLY. This repository contains leaked source code from the VanHelsing Ransomware-as-a-Service (RaaS) operation. It is published to support threat intelligence, incident response, and defensive security research. DO NOT deploy, execute, or use this code for malicious purposes. Doing so is illegal and unethical.
This repository contains the complete admin panel and blog/leak platform source code from the VanHelsing RaaS operation, leaked on April 9, 2025. VanHelsing is a sophisticated Ransomware-as-a-Service platform that provides affiliates with ransomware builder infrastructure, victim negotiation tools, cryptocurrency payment processing, and a data leak site.
The source code is published here to enable:
- Threat intelligence analysts to study RaaS infrastructure and operational patterns
- Incident responders to identify VanHelsing-specific IOCs and TTPs
- Security researchers to develop detection rules and defensive tooling
- Law enforcement to understand the operational model of modern RaaS groups
- Academic researchers studying the cybercrime ecosystem
| Component | Date | Description |
|---|---|---|
Admin Panel (backup-4-9-2025/) |
Apr 9, 2025 | Full affiliate management, builder, wallet, chat, and target management |
Blog/Leak Panel (blog_panel-3-21-2025/) |
Mar 21, 2025 | Public data leak site with victim publication system |
Este repositorio contiene el codigo fuente completo del panel de administracion y plataforma de filtraciones de la operacion VanHelsing RaaS, filtrado el 9 de abril de 2025. VanHelsing es una plataforma sofisticada de Ransomware-as-a-Service que proporciona a los afiliados infraestructura de builder de ransomware, herramientas de negociacion con victimas, procesamiento de pagos en criptomonedas y un sitio de filtracion de datos.
El codigo fuente se publica aqui para permitir:
- Analistas de inteligencia de amenazas estudiar la infraestructura RaaS y patrones operacionales
- Equipos de respuesta a incidentes identificar IOCs y TTPs especificos de VanHelsing
- Investigadores de seguridad desarrollar reglas de deteccion y herramientas defensivas
- Fuerzas del orden comprender el modelo operativo de grupos RaaS modernos
- Investigadores academicos que estudian el ecosistema del cibercrimen
Note
La documentacion tecnica completa en espanol esta disponible en docs/TECHNICAL_ANALYSIS_ES.md
VANHELSING RaaS — INFRASTRUCTURE MAP
═══════════════════════════════════════════════════════════════════════
┌─────────────────────────┐
│ ADMIN PANEL │
│ (PHP/MySQL/jQuery) │
│ Port: 443 (HTTPS) │
└────────────┬────────────┘
│
┌──────────────────────────┼──────────────────────────┐
│ │ │
┌───────▼────────┐ ┌───────────▼──────────┐ ┌──────────▼──────────┐
│ AFFILIATE │ │ BUILDER SERVICE │ │ BLOG/LEAK PANEL │
│ MANAGEMENT │ │ (api.php) │ │ (Separate Server) │
│ │ │ │ │ │
│ • Team CRUD │ │ • Win/Linux/ESXi │ │ • Leak publishing │
│ • User CRUD │ │ • Build queue │ │ • File tree mgmt │
│ • Role-based │ │ • Binary upload │ │ • Victim data │
│ access │ │ • Decrypter mgmt │ │ • News/FAQ/Blog │
└───────┬────────┘ └───────────┬──────────┘ └──────────┬──────────┘
│ │ │
┌───────▼────────┐ ┌───────────▼──────────┐ ┌──────────▼──────────┐
│ CHAT SYSTEM │ │ BITCOIN PAYMENT │ │ DATA MANAGEMENT │
│ │ │ PROCESSOR │ │ │
│ • Staff chat │ │ │ │ • File trees (JSON) │
│ • Media chat │ │ • Bitcoin Core RPC │ │ • Leak metadata │
│ • Target chat │ │ • Wallet generation │ │ • Expiration mgmt │
│ • Caller chat │ │ • Payment splits │ │ • Status tracking │
└────────────────┘ │ • Withdrawal system │ └─────────────────────┘
└──────────────────────┘
┌─────────────────────────────────────────────────────────────────────┐
│ MySQL DATABASES │
│ VanHesling_private: teams, users, targets, builder, wallets, │
│ staffchats, mediachats, targetchat, news, faqs │
│ VanHeslingBlog: leaks_blog, news, faqs │
└─────────────────────────────────────────────────────────────────────┘
DEVELOPER ──────────────── Highest privilege (platform owner)
│
ADMINISTRATOR ──────────── Platform operations management
│
MEDIA ──────────────────── Data publication & PR
│
AFFILIATE ──────────────── Ransomware operators (primary users)
│
SUB-USER ───────────────── Affiliate assistants
│
CALLER ─────────────────── Victim negotiation specialists
VICTIM ──── BTC Payment ────► TARGET WALLET
│
┌──────┴──────┐
│ AUTO-SPLIT │
└──────┬──────┘
│
┌────────────────┼────────────────┐
│ │ │
┌─────▼─────┐ ┌──────▼──────┐ ┌──────▼──────┐
│ AFFILIATE │ │ DEVELOPER │ │ ADMIN │
│ 80% │ │ ~4% │ │ ~16% │
└───────────┘ └─────────────┘ └─────────────┘
| Type | Value | Context |
|---|---|---|
| IPv4 | 45.120.177.99 |
Blog/Leak API server (port 8080) |
| IPv4 | 45.120.177.101 |
Chat history deletion API (port 8080) |
| Onion URL | vanhelvuuo4k3xsiq626zkqvp6kobc2abry5wowxqysibmqs5yjh4uqd.onion |
Public data leak site |
| Port | 8161 |
Admin panel (default) |
| Port | 8080 |
Blog API / Chat API |
| Port | 5840 |
Bitcoin Core RPC |
| Indicator | Value |
|---|---|
| Main DB name | VanHesling_private |
| Blog DB name | VanHeslingBlog |
| Bitcoin RPC user | bg1 |
| Bitcoin RPC port | 5840 |
| Path | Purpose |
|---|---|
/var/www/html/blog/inc/files_tree/*.json |
Stolen file tree storage |
admin/inc/cmd.php |
Action router (C2-like) |
admin/inc/functions.php |
Core business logic (~189KB) |
- HTTP POST to
/api/jolokia/or/api.php?action=get_builds_task - Bitcoin RPC calls to
getnewaddress/listreceivedbyaddress - CURL requests between panel servers for leak/chat management
- Session IDs: 128-character hex strings (
bin2hex(random_bytes(64)))
For the complete technical deep-dive, see:
- English:
docs/TECHNICAL_ANALYSIS_EN.md- Espanol:
docs/TECHNICAL_ANALYSIS_ES.md
1. Affiliate Management System
- Paid accounts: Require Bitcoin deposit (min 0.0006 BTC, 3 confirmations)
- Free accounts: Immediately activated
- Hierarchical roles: Developer > Administrator > Media > Affiliate > Sub-User > Caller
- Each affiliate gets a unique Bitcoin wallet address
- Password hashing: bcrypt (
PASSWORD_BCRYPT) - Session management with 128-char hex tokens
2. Ransomware Builder
- Supported platforms: Windows (32/64-bit), Linux, ESXi
- Build queue system with status tracking (waiting → processing → finished)
- External build servers compile binaries via API polling
- Decrypter tools managed separately (developer/admin only)
- Each build linked to a specific target with RSA-4096 keys
- Binary storage in MySQL BLOB columns
3. Bitcoin Payment Processor
- Integrated Bitcoin Core RPC client
- Automatic wallet generation per target/affiliate
- Blockchain monitoring with confirmation thresholds
- Ransom split: Affiliate 80% / Developer ~4% / Admin ~16%
- Deposit split: Developer 20% / Admin 80%
- Withdrawal system with PIN verification
4. Multi-Channel Chat System
- Staff Chat: Internal admin/developer/affiliate communication
- Media Chat: PR/publication coordination
- Target Chat: Victim negotiation (ransom payment discussions)
- Caller Chat: Specialized negotiation operators
- Real-time polling, read receipts, online status tracking
- Chat history deletion capability (developer-only, OPSEC feature)
5. Data Leak Platform
- Separate server/database from admin panel
- File tree publication (base64+gzip compressed JSON)
- Leak lifecycle: waiting → active → expired
- Expiration dates for victim pressure campaigns
- News, FAQ, and blog management for public-facing content
- Hosted on
.oniondomain via Tor
| Tactic | Technique | ID | VanHelsing Implementation |
|---|---|---|---|
| Resource Development | Acquire Infrastructure | T1583 | Dedicated servers (45.120.177.x), Tor hidden service |
| Resource Development | Develop Capabilities | T1587 | Multi-platform ransomware builder (Win/Linux/ESXi) |
| Initial Access | (Affiliate-dependent) | — | Builder provides payload; delivery is affiliate's responsibility |
| Execution | User Execution | T1204 | Compiled ransomware binaries |
| Impact | Data Encrypted for Impact | T1486 | RSA-4096 encryption per target |
| Impact | Data Destruction | T1485 | Implied by ransomware functionality |
| Exfiltration | Exfiltration Over Web Service | T1567 | File trees uploaded to leak platform |
| Collection | Data from Local System | T1005 | File tree generation for stolen data inventory |
| Command and Control | Web Protocols | T1071.001 | PHP-based C2 panel over HTTP/HTTPS |
| Command and Control | Proxy: Multi-hop Proxy | T1090.003 | Tor hidden service for leak site |
| Defense Evasion | Obfuscated Files | T1027 | MD5-hashed action names in API |
| Credential Access | (Affiliate-dependent) | — | Panel stores victim negotiation data |
VanHelsing-RaaS-Panel/
│
├── README.md # This file
├── LICENSE # Research license
│
├── docs/
│ ├── TECHNICAL_ANALYSIS_EN.md # Full technical report (English)
│ └── TECHNICAL_ANALYSIS_ES.md # Reporte tecnico completo (Espanol)
│
├── backup-4-9-2025/ # ADMIN PANEL (Apr 9, 2025)
│ ├── admin/
│ │ ├── inc/
│ │ │ ├── db.config.php # Database configuration
│ │ │ ├── functions.php # Core business logic (~189KB)
│ │ │ ├── cmd.php # Action router / dispatcher
│ │ │ ├── bitcoin.php # Bitcoin RPC payment processor
│ │ │ ├── old.bitcoin.php # Legacy payment code
│ │ │ ├── head.php # HTML head template
│ │ │ ├── topnav.php # Navigation bar
│ │ │ └── leftside.php # Sidebar menu
│ │ ├── assets/ # CSS, JS, images, fonts
│ │ ├── tools/ # Utilities
│ │ ├── login.php # Authentication
│ │ ├── index.php # Dashboard
│ │ ├── manage-targets.php # Victim/target management
│ │ ├── manage-builder.php # Ransomware builder interface
│ │ ├── manage-teams.php # Affiliate team management
│ │ ├── manage-users.php # Sub-user management
│ │ ├── manage-blogs.php # Leak blog management
│ │ ├── manage-news.php # News publishing
│ │ ├── manage-faq.php # FAQ management
│ │ ├── wallet.php # Cryptocurrency wallet & withdrawals
│ │ ├── account-settings.php # Password & settings
│ │ ├── staff-chats.php # Internal staff communication
│ │ ├── media-chats.php # Media team communication
│ │ ├── target-chats.php # Victim negotiation chat
│ │ ├── caller-chats.php # Caller negotiation chat
│ │ ├── news.php # News display
│ │ ├── faqs.php # FAQ display
│ │ └── logout.php # Session termination
│ ├── api.php # Builder API (build queue & upload)
│ ├── index.php # Root redirect
│ ├── update.php # RSA key generation (disabled)
│ └── test/ # CVE exploit code (lateral movement)
│
└── blog_panel-3-21-2025/ # BLOG/LEAK PANEL (Mar 21, 2025)
├── api.php # Leak management API
├── index.php # Root redirect
└── blog/
├── blog.php # Public blog display
├── index.php # Blog entry point
└── inc/
├── db.config.php # Blog database config
├── functions.php # Leak CRUD operations
├── head.php # HTML head
└── topnav.php # Navigation
# Detect VanHelsing builder API polling
title: VanHelsing Builder API Request
logsource:
category: webserver
detection:
selection:
cs-uri-query|contains:
- 'action=get_builds_task'
- 'action=upload_builds_task'
- 'action=upload_builds_decrypter_task'
condition: selection
# Detect VanHelsing leak site communication
title: VanHelsing Leak Site Network Activity
logsource:
category: firewall
detection:
selection:
dst_ip:
- '45.120.177.99'
- '45.120.177.101'
dst_port: 8080
condition: selectionrule VanHelsing_Panel_Indicator {
meta:
description = "Detects VanHelsing RaaS panel artifacts"
author = "KONDOR DEV SECURITY CORP"
date = "2025-04-09"
reference = "https://github.com/KONDORDEVSECURITYCORP/VanHelsing-RaaS-Panel"
strings:
$db1 = "VanHesling_private" ascii wide
$db2 = "VanHeslingBlog" ascii wide
$onion = "vanhelvuuo4k3xsiq626zkqvp6kobc2abry5wowxqysibmqs5yjh4uqd" ascii
$api1 = "get_builds_task" ascii
$api2 = "upload_builds_task" ascii
$func1 = "ProcessingTargetPayment" ascii
$func2 = "ProcessingAccounts" ascii
$func3 = "BitcoinCore_GenAddress" ascii
condition:
3 of them
}| Source | Link |
|---|---|
| MITRE ATT&CK — Ransomware | attack.mitre.org |
| CISA Ransomware Guide | cisa.gov |
| No More Ransom Project | nomoreransom.org |
| Ransomware Task Force | securityandtechnology.org |
Important
LEGAL NOTICE — AVISO LEGAL
English: This repository is published strictly for cybersecurity research, threat intelligence, and educational purposes. The source code contained herein was obtained from publicly leaked materials. No modifications have been made to enable malicious use. The publisher does not endorse, encourage, or support any criminal activity. Unauthorized deployment of ransomware is a federal crime in most jurisdictions.
Espanol: Este repositorio se publica estrictamente con fines de investigacion en ciberseguridad, inteligencia de amenazas y educacion. El codigo fuente contenido fue obtenido de materiales filtrados publicamente. No se han realizado modificaciones para habilitar uso malicioso. El publicador no respalda, alienta ni apoya ninguna actividad criminal. El despliegue no autorizado de ransomware es un delito federal en la mayoria de las jurisdicciones.
Published for the cybersecurity community by KONDOR DEV SECURITY CORP
Publicado para la comunidad de ciberseguridad por KONDOR DEV SECURITY CORP