Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · CRYSTALRAY · Unknown · misp-galaxy · refreshed 2026-10-06

CRYSTALRAY

sigil · no ATT&CK coverage stated

What changed

ledger · newest first
  1. 2026-10-18todaynew CVE3 new CVEs: CVE-2019-18394, CVE-2021-3129, CVE-2022-44877

Analyst brief

misp-galaxy

CRYSTALRAY is a threat actor known for leveraging open source tools like zmap and SSH-Snake to conduct widespread vulnerability scanning and exploitation. They target victims to collect and sell credentials, deploy cryptominers, and maintain persistence in compromised environments. CRYSTALRAY uses multiple backdoors to control access and spreads through victim networks using SSH-Snake. The actor also uses tools like Platypus for managing victims and extracting sensitive information from compromised systems.

CVEs CRYSTALRAY is cited as exploiting

none on KEV
  1. CVE-2019-183942026-10-17
    1. “Observed CVEs used by this attacker: CVE-2022-44877 CVE-2021-3129 CVE-2019-18394”

      cited as exploiting · named nearby · source: sysdig.com ↗ · 2026-10-17

  2. CVE-2021-31292026-10-17
    1. “Observed CVEs used by this attacker: CVE-2022-44877 CVE-2021-3129 CVE-2019-18394”

      cited as exploiting · named nearby · source: sysdig.com ↗ · 2026-10-17

  3. CVE-2022-448772026-10-17
    1. “Observed CVEs used by this attacker: CVE-2022-44877 CVE-2021-3129 CVE-2019-18394”

      cited as exploiting · named nearby · source: sysdig.com ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Detections

3 rules · Sigma · QRadar · Cortex

  1. CVE exploitation

    CVE-2022-44877 exploitation attempt

    CVE-2022-44877 · CRYSTALRAY

    T1190conf 70SIGAQLXQL

Generated by skopnix from this finding, each with false-positive notes. Open the list →

Take it with you

keyless · no signup

References

1 source
  1. 1.sysdig.com/blog/crystalray-rising-threat-actor-exploiting-oss-too…

Track CRYSTALRAY on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.