The VanHelsing ransomware-as-a-service (RaaS) operation has recently emerged as a significant threat, targeting a wide range of systems, including Windows, Linux, BSD, ARM, and ESXi. Initially promoted on cybercrime platforms on March 7, VanHelsing offers experienced affiliates a free pass to join, while less experienced threat actors must deposit $5,000. According to researchers, VanHelsing is a Russian cybercrime initiative that prohibits attacks on systems within Commonwealth of Independent States (CIS) countries. Affiliates retain 80% of ransom payments, with the operators making a 20% cut, managed via an automated escrow system with blockchain confirmations for security. Affiliates gain access to a fully automated panel and direct support from the development team. The ransomware’s dark web extortion portal currently lists three (3) victims, including a city in Texas and two (2) technology companies – one (1) in the U.S. and another in France. The operators threaten to release stolen data unless a $500,000 ransom is paid. VanHelsing, written in C++, was reportedly first deployed in the wild on March 16. It employs the ChaCha20 algorithm for file encryption, creating a 32-byte symmetric key and a 12-byte nonce for each file. These are further encrypted with a Curve25519 public key, storing the encrypted pair within the file. The ransomware partially encrypts files larger than 1GB but fully processes smaller files. The malware offers extensive CLI customization, allowing targeted attacks on specific drives and folders, limiting encryption scope, spreading via SMB, and enabling a two-phase stealth mode. In normal mode, it encrypts and renames files with a ‘.vanhelsing’ extension. In stealth mode, encryption is separated from renaming to avoid detection, ensuring the dataset is encrypted before alarms are triggered. Despite its advanced capabilities, VanHelsing shows signs of code immaturity, including mismatches in file extensions, errors in exclusion list logic, and unimplemented command-line flags. Nonetheless, VanHelsing poses a growing threat, with the potential to gain significant traction in the cybercrime landscape.