Skip to main content
Darkfield

Operator dossier

CRPX0 is a ransomware operator currently active on public leak sites. Darkfield has indexed 2 public victims claimed by this operator between August 10, 2026. CRPX0 is a ransomware group first observed in August 2026 with an apparent financial motivation, though its limited operational history makes comprehensive attribution difficult at this time. Based on available data, the group has claimed or been attributed to two known victims, with targeting activity concentrated in the United States and a notable focus on the healthcare sector, a pattern consistent with threat actors seeking high-pressure victims likely to pay ransoms quickly due to operational criticality. No public reporting from CISA, the FBI, Mandiant, or other reputable threat intelligence organizations has yet documented the group's specific initial access vectors, tooling, encryption methods, or extortion tactics in sufficient detail to make definitive technical assessments. No major high-profile campaigns, record ransom demands, or law enforcement actions against CRPX0 have been publicly documented as of the time of this profile. Given its very recent emergence and limited victim count, CRPX0 should be considered an early-stage or emerging threat actor whose full capabilities, affiliations, and operational scope remain largely uncharacterized pending further research and public disclosure.

Recent disclosures by CRPX0

All 2 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for CRPX0 →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Active ransomware operator

← All groups

CRPX0

2 victims indexed · first seen 6 days ago · last activity 6 days ago

2
Victims indexed
#321 of 391 tracked operators
<1m
Active period
Aug 2026 → Aug 2026
—
Countries hit

At a glance

Status
active
First seen
6 days ago
Last activity
6 days ago
Onion sites
1 known endpoint

About

CRPX0 is a ransomware group first observed in August 2026 with an apparent financial motivation, though its limited operational history makes comprehensive attribution difficult at this time. Based on available data, the group has claimed or been attributed to two known victims, with targeting activity concentrated in the United States and a notable focus on the healthcare sector, a pattern consistent with threat actors seeking high-pressure victims likely to pay ransoms quickly due to operational criticality. No public reporting from CISA, the FBI, Mandiant, or other reputable threat intelligence organizations has yet documented the group's specific initial access vectors, tooling, encryption methods, or extortion tactics in sufficient detail to make definitive technical assessments. No major high-profile campaigns, record ransom demands, or law enforcement actions against CRPX0 have been publicly documented as of the time of this profile. Given its very recent emergence and limited victim count, CRPX0 should be considered an early-stage or emerging threat actor whose full capabilities, affiliations, and operational scope remain largely uncharacterized pending further research and public disclosure.

References

1 link

External sources curated by the MISP threat-intel community.

Recent victims

Loading…

Onion infrastructure

1 known
  • http://tlxoddx4odmc2qvsmtsbgwwsv5j45osb5sox7mz6izxliuju5mkulzad.onion

Source

Updated 6 days ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time CRPX0 posts a victim.

Add CRPX0 to your watchlist — Pro pings you within 5 minutes of any new CRPX0 leak-site post, Telegram callout, or affiliate-rebrand inference.