Threat Group Profile
crypto24
Dormant / historical
Victim claims
3
First seen
Apr 2026
Last activity
17 Apr 2026
Tracked since
Apr 2025
Group overview
Crypto24 is a double-extortion ransomware-as-a-service group that surfaced on the RAMP forum in mid-2024, targeting large organizations in financial services, healthcare, manufacturing, and technology across Asia, Europe, and North America, with notable victims including CMC Group, Vietnam's second-largest ICT conglomerate.
Preferred targets
Manufacturing · 2
Healthcare · 1
Most targeted countries
QA · 1
MX · 1
ES · 1
