← Back to Hellcat profile

Hellcat — Ransom Notes

These are the actual ransom notes used by the hellcat ransomware group when communicating with victims. Ransom notes are left on compromised systems to inform victims of the attack and provide instructions for payment. Studying these notes helps security professionals understand threat actor tactics and communication patterns.
Disclaimer: These notes are displayed for educational and research purposes only. The URLs and contact methods mentioned in these notes are operated by criminal organizations. Do not interact with them. Source: Ransomware.live
📄 _README_
Your network has been breached and all data were encrypted. It can be restored to their original state with a decryptor key that only we have. Warning: 1. Do NOT modify encrypted files yourself. 2. Do NOT use third-party software to restore your data. 3. Do NOT hire a recovery company. They can not decrypt without out private key. 4. Do NOT reboot or turn off storage media. If you do not contact us within 3 days, or we cannot reach an agreement, informati on will either be sold, or shared with the media We have already downloaded a huge amount of critical data. Tags of downloaded information: - Confidential docs - Sales data - Finance documents - Business Plans - Resume - Personal data of employees - Oracle, Microsoft sql database backups - Full Gitlab backup - Tech data (network scheme, Remote Desktop Manager backup, etc.) Sources of information: 10.0.5.10 10.0.5.20 10.0.52.32 10.0.52.33 10.10.52.45 10.0.52.110 10.0.52.241 10.0.52.78 10.0.52.48 Total size of downloaded data: 723 GB You will not only receive a decryptor, but also a description of your network vulnerabilities and information security recommendations. If necessary, you will be provided with qualified data recovery assistance. As a proof of our statements, we are ready to restore some files for free and demonstrate how our product works. We guarantee that our negotiations will remain confidential. Contacts: Onion: hellcakbszllztlyqbjzwcbdhfrodx55wq77kmftp4bhnhsnn5r3odad.onion/ Login: [snip] Password: [snip] Mail: [email protected]
📄 _README_HELLCAT_
- IMPORTANT - All your files have been encrypted by the HellCat Ransomware. This includes documents, source codes, and any other critical data on your system. To regain access to your files, you must negotiate with us. We are open to discussing terms, but failure to communicate will result in your data being permanently leaked on our Tor network blog. Do not attempt to decrypt your files. Without our unique decryption key, there is no way to recover your data. Any unauthorized recovery attempts may cause permanent data corruption. After the deadline passes, all your sensitive files will be published, and further contact will not be entertained. This is your only chance to negotiate. Negotiate with us on TOX: F97D66EB390592BA053CC7C25C16ECDBE42F3C266DD2A99CB9D1DDABE69F6A41EF5FB3D9EE7F Our Onion site: [Redacted] ----- Read this wiki to set up TOX: hxxps://wiki.tox.chat/start Download Tor Browser: hxxps://www.torproject.org/download/ - HellCat Ransomware