New Helix ransomware group claims Highwoods Properties
An emerging ransomware group called Helix claims to have compromised Highwoods Properties, citing exposed FortiOS VPN credentials from the 2022 FortiBleed leak.
Ransomware.live has flagged a new extortion group, Helix, which surfaced on August 7, 2026, listing Highwoods Properties as a victim. The group operates a SharePoint-based staged leak site with tiered release timers (T1 through T4), a tactic used by several modern ransomware crews to pressure victims by gradually unlocking stolen data unless a ransom is paid before each timer expires.
The listing notes that the victim's FortiOS SSL-VPN credentials were previously exposed via the 2022 "FortiBleed" vulnerability (CVE-2022-40684), suggesting this unpatched or unrotated credential exposure may have served as an initial access vector, though this has not been independently confirmed. The claim currently includes a limited external attack surface footprint (3 compromised users, 3 external assets) and no confirmed employee or third-party credential compromise, indicating the intrusion claim is still unverified and should be treated cautiously as is standard for newly emerged ransomware brands.
No malicious infrastructure indicators (IPs, domains, hashes) are present in the listing itself — the DNS/WHOIS/TXT records referenced belong to legitimate third-party service providers (Mimecast, DocuSign, Canva, etc.) used by the victim organization and are not indicators of compromise.
Mentioned in this report
Detection guidance
Bulk Data Staging to External Cloud Storage from Internal SharePoint
Detects anomalous egress of large file volumes from SharePoint to external cloud storage (Box, Dropbox, OneDrive Personal) or file-sharing services, indicating data exfiltration for ransom staging. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Bulk Data Staging to External Cloud Storage from Internal SharePoint
description: Detects unusual volume of file operations (copy/upload) from internal
SharePoint service to external cloud storage services, consistent with attackers
staging stolen data for ransom extortion via leak site.
tags:
- attack.exfiltration
- attack.t1491.001
logsource:
category: file_event
product: windows
detection:
selection_sharepoint_process:
Image|endswith:
- \\w3wp.exe
- \\owstimer.exe
DestinationPath|contains:
- box.com
- dropbox.com
- onedrive.live.com
- mega.nz
- nextcloud
selection_large_transfer:
FileSize|gt: 104857600
filter_known_sync:
CommandLine|contains:
- OneDrive
- Sync
condition: (selection_sharepoint_process or selection_large_transfer) and not filter_known_sync
falsepositives:
- Legitimate file sync services configured for document backup
- IT-managed cloud storage integration for collaborative teams
level: medium
id: f66a60f7-b256-5709-a26d-cadaf4afe6e1
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ransomware.live/id/SGlnaHdvb2RzIFByb3BlcnRpZXNASGVsaXg=
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free