Ransomware needs a way in. Stolen credentials are the cheapest one.
cry0 Ransomware Group
Ransomware group profile
9Victims
North KoreaSource country
59Impact score
Description
The ransomware group cry0 emerged in March 2026, using data broker tactics to engage in direct and double extortion. They are known for encrypting victim data while threatening to leak it through a dedicated leak site on TOR networks.
Key insights
- •Employs direct and double extortion tactics.
- •Utilizes a data leak site accessible via TOR networks.
- •Engages in threats to leak stolen information publicly.
- •Offers free portions of leaked data to entice compliance.
- •Targets a wide array of sectors, including healthcare and education.
Threat Level & Status Breakdown
For cry0 · Based on incidents in selected period
0.9threat level
Aggressiveness2.5/ 10
Lethality0/ 10
Criticality0/ 10
Status Breakdown
Claimed100.0%9
First seenMar 2026
Last seenOct 2026
Avg ransom—
Payment rate—
Statusactive
Sophistication0
Last updatedOct 14, 2026
Recent activity
Monthly attack count for cry0 in the selected period
9Total attacks
5peak in Sep
1.8avg / month
No intelligence data for this group.
TTPs & Attack Vectors
Tools, initial access, and MITRE ATT&CK techniques for cry0
Other
T1486
T1486
T1490
T1490
T1078
T1078
T1059
T1059
T1562
T1562
T1021
T1021
T1547
T1547
T1021.001
T1021.001
T1080
T1080
T1027
T1027
Victims(6)
| Company | Country | Status | Discovered | |
|---|---|---|---|---|
| Anaergia | Canada | Claimed | 6 days ago | |
| MinMor Industries | United States | Claimed | 16 days ago | |
| Dini Autogru e Autotrasporti | Italy | Claimed | 19 days ago | |
| dinisrl.it | — | Claimed | 19 days ago | |
| Hope's Windows | United States | Claimed | 2 months ago | |
| Young Injury Law | United States | Claimed | 26 days ago |
Affected countries(15)
Countries where this group has been reported to target or leak victims.