File · crypto24 · Crime · ransomware.live · refreshed 2026-10-06
crypto24
sigil · no ATT&CK coverage stated
Analyst brief
ransomware.liveCrypto24 is a double-extortion ransomware-as-a-service group that surfaced on the RAMP forum in mid-2024, targeting large organizations in financial services, healthcare, manufacturing, and technology across Asia, Europe, and North America, with notable victims including CMC Group, Vietnam's second-largest ICT conglomerate.
Observed targets (as stated by the sources)
1 countries · 1 sectorsassessed originnot stated by sourcesobserved targets · 1
countries · 1
- Singapore
sectors · 1
- Not Found
as stated by MISP galaxy / ransomware.live — not inferred
Victims
leak-site listings via ransomware.live| Victims observed | First observed | Last observed on leak site | Lifetime rate |
|---|---|---|---|
| 1 | ≈ 1.0 / month |
- Victims observed
- 1
- First observed
- Last observed on leak site
- Lifetime rate
- ≈ 1.0 / month
lifetime rate = victims ÷ months from first to last observed · ▲ above that rate is worse · a quiet leak site says nothing about the crew
Take it with you
keyless · no signupReferences
1 sourceTrack crypto24 on the wire.
This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.