: Compromised internal ticketing systems via stolen employee logins.
: Rar files from threat groups often contain nested malicious scripts or "bombs" designed to compromise the host system. pdhellcat.rar
: Rar/Zip files are common containers for delivering the group's custom ransomware or auxiliary tools. Major 2025 Breaches Linked to Hellcat : Compromised internal ticketing systems via stolen employee
The Hellcat group (formerly known as ICA Group) is led by threat actors using the aliases and Rey . They are known for "humiliation tactics," publicly pressuring victims on leak sites and demanding ransoms in various forms, including unconventional requests like "baguettes" (referring to a specific cryptocurrency or a sarcastic demand during the Schneider Electric breach). Technical Write-up Summary Major 2025 Breaches Linked to Hellcat The Hellcat
: Given Hellcat's reliance on Jira, organizations should audit Atlassian Jira accounts for unusual login activity.