Crypto24 is a double-extortion ransomware-as-a-service group operating on the RAMP forum since mid-2024.
Crypto24 is a double-extortion ransomware-as-a-service group that surfaced on the RAMP forum in mid-2024. It targets large organizations primarily in financial services, healthcare, manufacturing, and technology sectors across Asia, Europe, and North America, with a notable victim being Vietnam's second-largest ICT conglomerate, CMC Group. The group relies on data exfiltration and encryption TTPs typical of double-extortion operations, though specific tools are not detailed in the provided information. Defenders should monitor for RAMP forum activity, reinforce backup strategies against double-extortion, and track cross-sector targeting patterns aligned with this group's focus.
Crypto24 is a double-extortion ransomware-as-a-service group that surfaced on the RAMP forum in mid-2024, targeting large organizations in financial services, healthcare, manufacturing, and technology across Asia, Europe, and North America, with notable victims including CMC Group, Vietnam's second-largest ICT conglomerate.
Crypto24 primarily targets large organizations in financial services, healthcare, manufacturing, and technology sectors.
Crypto24 surfaced on the RAMP forum in mid-2024.
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.