Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Enjoying ransomware.live? Help us keep tracking ransomware gangs and shipping new features. Support us

Crypto24

Active RaaS
World map Statistics
Crypto24 is a double-extortion ransomware-as-a-service group that surfaced on the RAMP forum in mid-2024, targeting large organizations in financial services, healthcare, manufacturing, and technology across Asia, Europe, and North America, with notable victims including CMC Group, Vietnam's second-largest ICT conglomerate.
Victims
49
none this month
Rank
#111 / 388
#87 over the last 12 months
First victim
2023-12-13
estimated attack date
Last victim
2026-10-27
19 days ago
Attack → claim
60.8 d
average delay
Countries
25
hit
Infostealer
50.0%
of victims with a domain
Data leaked
19.4 TB
reported for 23 victims
Leak-site uptime
91.0% average, 30 days

Victims per month

By estimated attack date when known, otherwise by discovery date.

Top sectors

  • Technology 11 · 22%
  • Manufacturing 7 · 14%
  • Professional Services 7 · 14%
  • Healthcare 6 · 12%
  • Financial Services 6 · 12%
  • Hospitality 4 · 8%
  • Retail & E-Commerce 2 · 4%
  • Education 1 · 2%
  • Transportation 1 · 2%

Top countries

What ransomware.live knows about crypto24