Threat Group Profile

crypto24

Dormant / historical

Victim claims 3

First seen Apr 2026

Last activity 17 Apr 2026

Tracked since Apr 2025

Group overview

Crypto24 is a double-extortion ransomware-as-a-service group that surfaced on the RAMP forum in mid-2024, targeting large organizations in financial services, healthcare, manufacturing, and technology across Asia, Europe, and North America, with notable victims including CMC Group, Vietnam's second-largest ICT conglomerate.

Preferred targets

Manufacturing · 2 Healthcare · 1

Most targeted countries

QA · 1 MX · 1 ES · 1

Victim Claims Timeline

Back to radar

🇶🇦 Qatar 17 Apr 2026

Qatar Biomedical Research Institute (QBRI)

www.hbku.edu.qa/en/qbri

[AI generated] Qatar Biomedical Research Institute (QBRI) is a research institute based in Qatar, operating under Hamad Bin Khalifa University. It focuses on biomedical r...

Healthcare

🇲🇽 Mexico 02 Apr 2026

Katcon Global

katcon.com

[AI generated] "Katcon Global" is a prominent automotive supplier, specialized in the field of developing, designing, and manufacturing advanced vehicle exhaust systems....

Manufacturing

🇪🇸 Spain 02 Apr 2026

Industrias Guerra, S.A.

www.iguerra.com

[AI generated] Industrias Guerra, S.A. is a prominent Spanish company known for the manufacturing of marine cranes, forestry machinery, and special equipment. Its product...