Skip to main content
Darkfield

Operator dossier

crypto24 is a ransomware operator currently active on public leak sites. Darkfield has indexed 49 public victims claimed by this operator between April 8, 2025 and May 18, 2026. Crypto24 is a recently emerged ransomware group first observed in April 2025, with a primary financial motivation evidenced by their targeting of high-value sectors across multiple geographic regions. The group's origin and affiliations remain unclear due to their recent emergence, though their targeting pattern suggests either independent operations or a new ransomware-as-a-service offering given the diverse geographic spread of their 43 documented victims. Their attack methodology and specific technical capabilities have not yet been thoroughly documented by major threat intelligence providers, though their targeting of technology, financial services, healthcare, and business services sectors indicates they likely employ common initial access vectors such as phishing or exploitation of public-facing applications to gain entry into victim networks. The group has demonstrated a preference for targeting organizations primarily in the United States while also conducting operations across Southeast Asia including Malaysia, Singapore, and Indonesia, as well as extending their reach to Egypt, suggesting either a globally distributed affiliate network or opportunistic targeting based on vulnerable infrastructure discovery. Crypto24 remains active as of the latest available intelligence reporting, though given their recent emergence, comprehensive details about their specific tactics, techniques, and procedures await further analysis by established cybersecurity research organizations.

Most-targeted sectors

Most-affected countries

Recent disclosures by crypto24

All 49 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for crypto24 →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Active ransomware operator

← All groups

crypto24

49 victims indexed · first seen 1 year ago · last activity 2 months ago

49
Victims indexed
#106 of 364 tracked operators
1y 1m
Active period
Apr 2025 → May 2026
10
Countries hit
top US · 7

At a glance

Status
active
First seen
1 year ago
Last activity
2 months ago
Onion sites
1 known endpoint
Primary sector
Not Found · 14 hits

About

Crypto24 is a recently emerged ransomware group first observed in April 2025, with a primary financial motivation evidenced by their targeting of high-value sectors across multiple geographic regions. The group's origin and affiliations remain unclear due to their recent emergence, though their targeting pattern suggests either independent operations or a new ransomware-as-a-service offering given the diverse geographic spread of their 43 documented victims. Their attack methodology and specific technical capabilities have not yet been thoroughly documented by major threat intelligence providers, though their targeting of technology, financial services, healthcare, and business services sectors indicates they likely employ common initial access vectors such as phishing or exploitation of public-facing applications to gain entry into victim networks. The group has demonstrated a preference for targeting organizations primarily in the United States while also conducting operations across Southeast Asia including Malaysia, Singapore, and Indonesia, as well as extending their reach to Egypt, suggesting either a globally distributed affiliate network or opportunistic targeting based on vulnerable infrastructure discovery. Crypto24 remains active as of the latest available intelligence reporting, though given their recent emergence, comprehensive details about their specific tactics, techniques, and procedures await further analysis by established cybersecurity research organizations.

References

5 links

External sources curated by the MISP threat-intel community.

Timeline

12 months
2025-04-01T00:00:00+00:00 · 82025-05-01T00:00:00+00:00 · 22025-06-01T00:00:00+00:00 · 22025-07-01T00:00:00+00:00 · 92025-08-01T00:00:00+00:00 · 42025-09-01T00:00:00+00:00 · 12025-10-01T00:00:00+00:00 · 42025-11-01T00:00:00+00:00 · 22025-12-01T00:00:00+00:00 · 32026-01-01T00:00:00+00:00 · 22026-02-01T00:00:00+00:00 · 12026-03-01T00:00:00+00:00 · 5
2025-04-01T00:00:00+00:002026-03-01T00:00:00+00:00

Top countries

🇺🇸 United States
7
🇲🇾 Malaysia
3
🇸🇬 Singapore
3
🇮🇩 Indonesia
3
🇪🇬 Egypt
2
🇮🇳 India
2
🇦🇷 Argentina
2
🇮🇹 Italy
2
United States dossier →Malaysia dossier →Singapore dossier →Indonesia dossier →

Top sectors

Technology
7
Financial Services
5
Healthcare
4
Business Services
3
Manufacturing
3
Construction
2
Hospitality and Tourism
2
Education
1
Technology dossier →Financial Services dossier →Healthcare dossier →Business Services dossier →

MITRE ATT&CK

3 techniques · 3 tactics

Tactics

Initial AccessExecutionImpact

Techniques

  • T1566Phishing
  • T1059Command and Scripting Interpreter
  • T1486Data Encrypted for Impact

Recent victims

Loading…

Onion infrastructure

1 known
  • http://j5o5y2feotmhvr7cbcp2j2ewayv5mn5zenl3joqwx67gtfchhezjznad.onion

Source

Updated 2 months ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time crypto24 posts a victim.

Add crypto24 to your watchlist — Pro pings you within 5 minutes of any new crypto24 leak-site post, Telegram callout, or affiliate-rebrand inference.