Skip to main content
Darkfield

Operator dossier

Cryp70N1C0D3 is a ransomware operator no longer publishing new disclosures. Darkfield has indexed 11 public victims claimed by this operator between December 18, 2021. Cryp70N1C0D3 is a relatively obscure ransomware group that emerged in December 2021, primarily motivated by financial gain through ransomware operations. The group's origin and affiliations remain largely undocumented in public threat intelligence reporting, though their targeting patterns suggest potential familiarity with victims in India, the United States, and Turkey. Based on available data, Cryp70N1C0D3 has maintained a limited operational scope with only 11 documented victims across their known period of activity, indicating either a small-scale operation or highly selective targeting approach. The group's attack methodology, encryption techniques, and specific tactics, techniques, and procedures have not been extensively documented by major cybersecurity firms or government agencies, likely due to their relatively low profile compared to more prominent ransomware families. No significant high-profile attacks, major corporate victims, or substantial law enforcement actions have been publicly reported in connection with this group. Current intelligence suggests limited ongoing activity, though the group's present operational status remains unclear due to insufficient public reporting and analysis from established threat intelligence sources.

Most-affected countries

Recent disclosures by Cryp70N1C0D3

All 11 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for Cryp70N1C0D3 →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Inactive ransomware operator

← All groups

Cryp70N1C0D3

11 victims indexed · first seen 5 years ago · last activity 5 years ago

11
Victims indexed
#204 of 364 tracked operators
<1m
Active period
Dec 2021 → Dec 2021
3
Countries hit
top India · 5

At a glance

Status
inactive
First seen
5 years ago
Last activity
5 years ago
Onion sites
2 known endpoints

About

Cryp70N1C0D3 is a relatively obscure ransomware group that emerged in December 2021, primarily motivated by financial gain through ransomware operations. The group's origin and affiliations remain largely undocumented in public threat intelligence reporting, though their targeting patterns suggest potential familiarity with victims in India, the United States, and Turkey. Based on available data, Cryp70N1C0D3 has maintained a limited operational scope with only 11 documented victims across their known period of activity, indicating either a small-scale operation or highly selective targeting approach. The group's attack methodology, encryption techniques, and specific tactics, techniques, and procedures have not been extensively documented by major cybersecurity firms or government agencies, likely due to their relatively low profile compared to more prominent ransomware families. No significant high-profile attacks, major corporate victims, or substantial law enforcement actions have been publicly reported in connection with this group. Current intelligence suggests limited ongoing activity, though the group's present operational status remains unclear due to insufficient public reporting and analysis from established threat intelligence sources.

References

1 link

External sources curated by the MISP threat-intel community.

Timeline

1 months
2021-12-01T00:00:00+00:00 · 11
2021-12-01T00:00:00+00:002021-12-01T00:00:00+00:00

Top countries

🇮🇳 India
5
🇺🇸 United States
1
🇹🇷 Turkey
1
India dossier →United States dossier →Turkey dossier →

MITRE ATT&CK

4 techniques · 4 tactics

Tactics

Initial AccessExecutionDefense EvasionImpact

Techniques

Recent victims

Loading…

Onion infrastructure

2 known
  • http://7k4yyskpz3rxq5nyokf6ztbpywzbjtdfanweup3skctcxopmt7tq7eid.onion
  • http://7k4yyskpz3rxq5nyokf6ztbpywzbjtdfanweup3skctcxopmt7tq7eid.onion/databases.html

Source

Updated 5 years ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time Cryp70N1C0D3 posts a victim.

Add Cryp70N1C0D3 to your watchlist — Pro pings you within 5 minutes of any new Cryp70N1C0D3 leak-site post, Telegram callout, or affiliate-rebrand inference.