# New Helix ransomware group claims Highwoods Properties

Published: 2026-08-07 · Severity: high
Canonical: https://vorant.io/reports/8855e12c-1088-5e73-a1f8-da0b3e0a14d2/new-helix-ransomware-group-claims-highwoods-properties

> An emerging ransomware group called Helix claims to have compromised Highwoods Properties, citing exposed FortiOS VPN credentials from the 2022 FortiBleed leak.

Ransomware.live has flagged a new extortion group, Helix, which surfaced on August 7, 2026, listing Highwoods Properties as a victim. The group operates a SharePoint-based staged leak site with tiered release timers (T1 through T4), a tactic used by several modern ransomware crews to pressure victims by gradually unlocking stolen data unless a ransom is paid before each timer expires.

The listing notes that the victim's FortiOS SSL-VPN credentials were previously exposed via the 2022 "FortiBleed" vulnerability (CVE-2022-40684), suggesting this unpatched or unrotated credential exposure may have served as an initial access vector, though this has not been independently confirmed. The claim currently includes a limited external attack surface footprint (3 compromised users, 3 external assets) and no confirmed employee or third-party credential compromise, indicating the intrusion claim is still unverified and should be treated cautiously as is standard for newly emerged ransomware brands.

No malicious infrastructure indicators (IPs, domains, hashes) are present in the listing itself — the DNS/WHOIS/TXT records referenced belong to legitimate third-party service providers (Mimecast, DocuSign, Canva, etc.) used by the victim organization and are not indicators of compromise.

## Mentioned in this report

- Vulnerabilities: CVE-2022-40684 (KEV)
- Threat actors: Helix
- Malware: Helix

## Detection guidance (public sample)

### Bulk Data Staging to External Cloud Storage from Internal SharePoint

ATT&CK: T1491.001

Detects anomalous egress of large file volumes from SharePoint to external cloud storage (Box, Dropbox, OneDrive Personal) or file-sharing services, indicating data exfiltration for ransom staging. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Bulk Data Staging to External Cloud Storage from Internal SharePoint
description: Detects unusual volume of file operations (copy/upload) from internal
  SharePoint service to external cloud storage services, consistent with attackers
  staging stolen data for ransom extortion via leak site.
tags:
- attack.exfiltration
- attack.t1491.001
logsource:
  category: file_event
  product: windows
detection:
  selection_sharepoint_process:
    Image|endswith:
    - \\w3wp.exe
    - \\owstimer.exe
    DestinationPath|contains:
    - box.com
    - dropbox.com
    - onedrive.live.com
    - mega.nz
    - nextcloud
  selection_large_transfer:
    FileSize|gt: 104857600
  filter_known_sync:
    CommandLine|contains:
    - OneDrive
    - Sync
  condition: (selection_sharepoint_process or selection_large_transfer) and not filter_known_sync
falsepositives:
- Legitimate file sync services configured for document backup
- IT-managed cloud storage integration for collaborative teams
level: medium
id: f66a60f7-b256-5709-a26d-cadaf4afe6e1
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ransomware.live/id/SGlnaHdvb2RzIFByb3BlcnRpZXNASGVsaXg=

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/8855e12c-1088-5e73-a1f8-da0b3e0a14d2/new-helix-ransomware-group-claims-highwoods-properties.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup