crpxo Ransomware Group

Key insights

• •Targets small-to-medium healthcare providers, particularly dental practices.
• •Employs a double-extortion model, combining data encryption with data theft.
• •Initial access via phishing emails and exploitation of remote desktop protocols.
• •Utilizes legitimate system administrative tools to maintain persistent access.
• •Publicly leaks stolen data to pressure victims into paying ransoms.
• •Recently launched an affiliate recruitment program to attract external operators.