CRY0 is a ransomware operator currently active on public leak sites. Darkfield has indexed 2 public victims claimed by this operator between May 17, 2026 and July 6, 2026. CRY0 is a ransomware group first observed in May 2026 with an apparent financial motivation, though its limited activity to date makes comprehensive attribution difficult. With only a single confirmed victim recorded and a targeting pattern focused on the transportation and automotive sectors, the group remains nascent and has not yet accumulated sufficient operational history to establish a well-documented profile in open-source intelligence reporting by organizations such as CISA, the FBI, Mandiant, or comparable security research firms. No confirmed country of origin, RaaS affiliation, or links to established threat actor clusters have been publicly documented at this time. Similarly, specific details regarding initial access vectors, tooling, encryption methodologies, or data exfiltration practices have not been publicly attributed to CRY0 by reputable sources, and no notable high-profile campaigns, record ransom demands, or law enforcement actions have been recorded against the group. Given its emergence in May 2026 and minimal victim count, CRY0 should be regarded as an emerging and unverified threat actor warranting continued monitoring, particularly within transportation and automotive industry verticals, as future activity may yield more substantive intelligence to support a fuller threat assessment.

Recent disclosures by CRY0

Most recent 1 of 2 indexed disclosures. Click any row for the full per-victim dossier.

• DINITransportation and Automotive · May 17, 2026

See every disclosure indexed for CRY0 →