Ransomware group
Helix ransomware: victims and leak site activity
The Helix ransomware group has listed 13 victims on its leak site since August 2026; its latest post is from 18 October 2026. Most affected countries: United States and Canada. Most targeted sector: Manufacturing.
Total posts
13
First seen
2026-08-07
Latest post
2026-10-18
Countries hit
2
About Helix
- Also known as
- UNC7761
- Leak site (Tor)
- http://helixr2sncrd3ndsz5oho6mzqw3x5u7mvox5zcsngc5wm7v4l5k7oryd.onion
- Profile
- ransomware.live
Most targeted countries
- United States 11
- Canada 1
Most targeted sectors
- Manufacturing 3
- Energy & Utilities 2
- Professional Services 2
- Transportation 2
- Financial Services 1
- Healthcare 1
Helix victims per year
All 13 victims
Search every post in the full table.| Victim | Country | Sector | Discovered |
|---|---|---|---|
| Quikrete | United States | Manufacturing | |
| Personify Health | United States | Healthcare | |
| Bay Alarm | United States | Professional Services | |
| Smith Douglas Homes | United States | Manufacturing | |
| Rheem Global | United States | Manufacturing | |
| AmSpec | United States | Energy & Utilities | |
| Delek US | United States | Energy & Utilities | |
| Kennedy Jenks | United States | Professional Services | |
| Venture Logistics | — | Transportation | |
| Uber | United States | Transportation | |
| Highwoods Properties | United States | Other | |
| Morguard | United States | — | |
| Westland Insurance | Canada | Financial Services |