CRASL Data Breach

The ransomware group TheGentlemen has claimed CRASL, a UK-based organization, as a victim, listing it on their leak site on August 19, 2026. SOCRadar’s Dark Web Monitoring identified this claim. The listing also included four other victims from South Africa, Sweden, Canada, and Italy, suggesting a broad, international targeting campaign by the threat actor. This incident is particularly concerning due to the apparent ease of initial access, with two employee credentials found associated with an internet-facing RDWeb portal, which serves as a direct entry point into an organization’s network. TheGentlemen has been active, claiming CRASL alongside four other victims in the period leading up to August 19, 2026. While specific details on TheGentlemen’s most frequently targeted industries or countries are not detailed in this instance, the inclusion of victims from South Africa, Sweden, Canada, and Italy indicates a diverse geographic reach. The pattern of recent claims and the nature of the identified access vector for CRASL suggest a focus on exploiting readily available remote access points.

SOCRadar’s Dark Web Monitoring identified a listing for CRASL on TheGentlemen’s leak site, dated August 19, 2026. The analysis of stealer-log data correlated with the domain `crasl[.]co.uk` yielded two employee credential records. These credentials were found to authenticate against the RDWeb portal located at `desktop2.crasl[.]co.uk/rdweb`. RDWeb, being a browser-based Remote Desktop gateway, allows authenticated users direct access to an organization’s Windows environment without the necessity of a separate VPN connection. The captured credentials were valid for the period between June 20 and July 26, 2026, indicating that the potential for access existed for three to eight weeks prior to the leak site listing. This method of access is notable for its simplicity, as it requires no sophisticated exploits, phishing campaigns, or additional tooling for initial compromise, relying solely on the harvested credentials. The identified two records represent a small sample size, but this does not diminish the severity of the potential access. The presence of harvested credentials for RDWeb provides a direct pathway to internal infrastructure, bypassing perimeter defenses that might otherwise mitigate threats. This direct authentication mechanism is considered a highly efficient route for ransomware deployment. Recommended Actions: Determine whether `desktop2.crasl[.]co.uk/rdweb` remains internet-accessible. If it does, restrict access to known IP ranges or implement VPN-gated access. Force-rotate credentials for all accounts associated with the identified records. Review RDWeb session logs for the June–August window to identify any anomalous activity.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.