Ransomware Intelligence / Groups / crypto24

Ransomware group

crypto24

Also known as: >Crypto24 emerged in early 2025 as a fast-growing double-extortion ransomware-as-a-service (RaaS) group. It targets organization, 2 TB from Vietnam’s CMC Group). Affiliate-oriented operations are indicated by their presence on RAMP forums, Colombia, Egypt, exfiltrates significant volumes of data (e.g., healthcare, India. The group executes rapid infiltration—often leveraging stolen credentials—encrypts files (appending the .crypto24 extensi, logistics, offering free decryption for small file samples to entice victims., Public Data Storage <br, suggesting professional recruitment, technology, with notable victims in Malaysia

aka Public Data Storage <br/>Crypto24 emerged in early 2025 as a fast-growing double-extortion ransomware-as-a-service (RaaS) group. It targets organizations across industries such as financial services, healthcare, logistics, and technology, with notable victims in Malaysia, Colombia, Egypt, and India. The group executes rapid infiltration—often leveraging stolen credentials—encrypts files (appending the .crypto24 extension), and exfiltrates significant volumes of data (e.g., 2 TB from Vietnam’s CMC Group). Affiliate-oriented operations are indicated by their presence on RAMP forums, suggesting professional recruitment and offering free decryption for small file samples to entice victims.

• 0claims, 7 days
• 0claims, 30 days
• 1claims, 90 days
• 2026-08-31first seen
• 2026-08-31last seen

These are claims posted by the group on its leak site, counted when we first see them. They are not confirmed incidents, and we never name a victim.