Latest Research on INC and The Gentlemen Ransomware: Exposed AI Infrastructure
crypto24 Ransomware Group
Ransomware group profile
Description
Crypto24 is a ransomware group that emerged in July 2024, operating under a Ransomware-as-a-Service model with a focus on financial gain through data encryption and extortion. Known for its use of legitimate IT tools combined with custom malware, the group conducts stealthy, multi-stage attacks and primarily targets organizations during off-peak hours to evade detection.
Key insights
- •Utilizes phishing and exploited RDP services for initial access.
- •Employs proprietary ransomware that appends a '.crypto24' extension to encrypted files.
- •Implements a double extortion scheme, threatening to leak stolen data if ransom is not paid.
- •Uses legitimate administrative tools like PSExec and AnyDesk for lateral movement.
- •Targets various sectors including manufacturing, healthcare, and legal services.
Threat Level & Status Breakdown
For crypto24 · Based on incidents in selected period
Status Breakdown
Recent activity
Monthly attack count for crypto24 in the selected period
Intelligence
IOCs, YARA/Sigma rules, and related families for crypto24
- 8057d42ddb591dbc1a92e4dd23f931ab6892bcac
- 3b0b4a11ad576588bae809ebb546b4d985ef9f37ed335ca5e2ba6b886d997bac
- f353a8387e1c1a526f1b02bd3d6558d6
- 47ba2db66791b92e6b5a12f35717bbe6286777794b7964efb6a509e51a4e74f1
- 093902737a7850c6c715c153cd13e34c86d60992
- 0eae3b3db725dbd017852e0d752184f5
TTPs & Attack Vectors
Tools, initial access, and MITRE ATT&CK techniques for crypto24
T1486
T1486
T1490
T1490
T1021
T1021
T1562
T1562
T1078
T1078
T1547
T1547
T1059
T1059
T1046
T1046
T1021.001
T1021.001
T1037
T1037
T1080
T1080
T1071
T1071
Victims(17)
| Company | Country | Status | Discovered | |
|---|---|---|---|---|
| DATEM, Inc. | Philippines | Claimed | 1 day ago | |
| Antah HealthCare Group | Malaysia | Claimed | 1 day ago | |
| Hamad Bin Khalifa University (HBKU) | Qatar | Claimed | 6 months ago | |
| Katcon | Mexico | Claimed | 7 months ago | |
| Industrias Guerra | Spain | Claimed | 7 months ago | |
| ActionPower | Croatia | Claimed | 7 months ago | |
| O’Farrell | Argentina | Claimed | 7 months ago | |
| Invaccs | India | Claimed | 8 months ago | |
| Comprehensive Orthopaedics | United States | Claimed | 8 months ago | |
| Rowad Modern Engineering | Egypt | Claimed | 8 months ago | |
| Putnam Precision | United States | Claimed | 9 months ago | |
| University College London | United Kingdom | Claimed | 9 months ago | |
| Yource Bulgaria & Greece | Bulgaria | Claimed | 9 months ago | |
| ExamRoom.AI | United States | Claimed | 10 months ago | |
| SASP | France | Claimed | 11 months ago | |
| Hollysys Asia Pacific | Singapore | Claimed | 11 months ago | |
| AsahiKASEI MICRODEVICES | United States | Claimed | 12 months ago |
Affected countries(37)
Countries where this group has been reported to target or leak victims.