Skip to main content
Darkfield

Operator dossier

CRPxO is a ransomware operator currently active on public leak sites. Darkfield has indexed 6 public victims claimed by this operator between July 9, 2026. CRPxO is a ransomware group first observed in July 2026 with a primary financial motivation, having claimed six known victims to date with a notable focus on the healthcare sector across the United States and China. Due to the group's recent emergence and limited public footprint, comprehensive technical attribution and operational details have not yet been documented by CISA, the FBI, Mandiant, or other reputable threat intelligence sources. Based on available victimology data, the group demonstrates a deliberate targeting pattern favoring healthcare organizations in the US and CN, a sector frequently selected for its sensitivity to operational disruption and willingness to pay ransoms to restore critical services. No confirmed country of origin, RaaS affiliation, specific tooling, or extortion methodology has been publicly attributed to CRPxO at this time, and the group's infrastructure, encryption methods, and initial access vectors remain uncharacterized in open-source reporting. With only six known victims and a short operational history, CRPxO should be considered an emerging and actively monitored threat, though its current operational status and potential for escalation or rebranding cannot be confirmed based on publicly available intelligence.

Most-targeted sectors

Most-affected countries

Recent disclosures by CRPxO

All 6 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for CRPxO →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Active ransomware operator

← All groups

CRPxO

6 victims indexed · first seen 6 days ago · last activity 6 days ago

6
Victims indexed
#238 of 364 tracked operators
<1m
Active period
Jul 2026 → Jul 2026
2
Countries hit
top US · 5

At a glance

Status
active
First seen
6 days ago
Last activity
6 days ago
Primary sector
Healthcare · 6 hits

About

CRPxO is a ransomware group first observed in July 2026 with a primary financial motivation, having claimed six known victims to date with a notable focus on the healthcare sector across the United States and China. Due to the group's recent emergence and limited public footprint, comprehensive technical attribution and operational details have not yet been documented by CISA, the FBI, Mandiant, or other reputable threat intelligence sources. Based on available victimology data, the group demonstrates a deliberate targeting pattern favoring healthcare organizations in the US and CN, a sector frequently selected for its sensitivity to operational disruption and willingness to pay ransoms to restore critical services. No confirmed country of origin, RaaS affiliation, specific tooling, or extortion methodology has been publicly attributed to CRPxO at this time, and the group's infrastructure, encryption methods, and initial access vectors remain uncharacterized in open-source reporting. With only six known victims and a short operational history, CRPxO should be considered an emerging and actively monitored threat, though its current operational status and potential for escalation or rebranding cannot be confirmed based on publicly available intelligence.

Timeline

1 months
2026-07-01T00:00:00+00:00 · 6
2026-07-01T00:00:00+00:002026-07-01T00:00:00+00:00

Top countries

🇺🇸 United States
5
🇨🇳 China
1
United States dossier →China dossier →

Top sectors

Healthcare
6
Healthcare dossier →

MITRE ATT&CK

11 techniques · 7 tactics

Tactics

Initial AccessExecutionDefense EvasionDiscoveryCollectionExfiltrationImpact

Techniques

  • T1190Exploit Public-Facing Application
  • T1566Phishing
  • T1059Command and Scripting Interpreter
  • T1562Impair Defenses
  • T1082System Information Discovery
  • T1083File and Directory Discovery
  • T1486Data Encrypted for Impact
  • T1490Inhibit System Recovery
  • T1005Data from Local System
  • T1041Exfiltration Over C2 Channel
  • T1489Service Stop

Recent victims

Loading…

Source

Updated 6 days ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time CRPxO posts a victim.

Add CRPxO to your watchlist — Pro pings you within 5 minutes of any new CRPxO leak-site post, Telegram callout, or affiliate-rebrand inference.