A relatively new ransomware group – Helldown – has been expanding its ransomware capabilities to target VMware ESXi environments and Linux systems. The Helldown ransomware strain was first identified by researchers in August 2024, targeting sectors including IT services, telecommunications, manufacturing, and healthcare. The group has attacked over thirty companies since it arrived on the scene just a few months ago. Helldown has been observed exploiting vulnerabilities in Zyxel firewall appliances to initially breach networks, stealing credentials and creating SSL VPN tunnels to maintain access. The Windows variant of the ransomware deletes shadow copies and terminates processes prior to encrypting files and self-destructing. The ransomware appears to be a variant of the leaked LockBit 3.0 ransomware, and its artifacts share similarities with ransomware group DarkRace or DoNex. Recently, the group has been observed deploying a new Linux version of its ransomware which appears to still be under development. The Linux version lacks obfuscation and anti-debugging mechanisms. Cybersecurity researchers have analyzed one such variant and noted that the ransomware does not appear to have a mechanism for network communication to share a secret or public key, raising the question of how Helldown would be able to provide a decryptor for the ransomware. The group appears to be expanding its capabilities to target virtualized infrastructures, an increasingly common and popular target for ransomware attacks. CTIX analysts will continue to report on new and emerging forms of malware and associated campaigns.