Crypto24 Ransomware Disrupts Businesses Using Custom EDR Bypass

Red | Attack Report

Crypto24 Ransomware Threat Advisory 2025

Global Ransomware Surge Targeting Critical Industries

Crypto24 ransomware, first detected in September 2024, has rapidly evolved into a global cybersecurity threat. This ransomware operation has targeted industries across Asia, Europe, Egypt, Canada, the United States, Argentina, and Colombia. Victims span critical sectors such as banking, defense, healthcare, aerospace, telecommunications, manufacturing, logistics, and IT services. By exploiting legitimate IT tools alongside custom-built malware, the group has become one of the most adaptive ransomware actors in 2025.

Attack Overview

Stealth, Multi-Stage Ransomware Campaigns

Crypto24 leverages a multi-stage attack chain that blends in with legitimate IT operations. Tactics include:

Using PSExec for lateral movement and AnyDesk for persistence.
Employing keyloggers for credential theft and multiple backdoors for deeper infiltration.
Exploiting Google Drive for covert data exfiltration.
Abusing gpscript.exe to uninstall endpoint protection (Trend Vision One).

Its activity surged in July–August 2025, marking the most aggressive campaign, striking Malaysia, the U.S., and Italy with sector-wide disruptions.

Targeted Regions and Industries

Widespread Impact Across Multiple Countries

Asia – Attacks concentrated in Malaysia, hitting manufacturing, transportation, and tech.
United States – Healthcare, education, and telecom were prime victims.
Europe – Aerospace, defense, and agriculture sectors in Italy were heavily impacted.

Industries most at risk include banking, insurance, pharmaceuticals, logistics, technology, human resources, food services, and gaming.

Persistence and Defense Evasion

Living Off the Land with Weaponized IT Tools

Crypto24 maintains persistence by:

Enabling or creating Windows admin accounts.
Running malicious services like WinMainSvc (keylogger) and MSRuntime (ransomware loader).
Deploying scheduled tasks for stealth persistence.

The ransomware evades detection by abusing trusted system tools and disguising malicious actions within legitimate workflows.

Recommendations for Organizations

Best Practices for Ransomware Defense

Strengthen Account & Access Controls – Audit privileged accounts, disable unused ones, and enforce MFA.
Harden Remote Access – Restrict RDP and tools like PsExec and AnyDesk.
Enhance Monitoring – Detect suspicious use of native Windows utilities and abnormal outbound traffic.
Backup & Recovery – Implement the 3-2-1 backup strategy with immutable and offsite storage.
Incident Preparedness – Continuously validate defenses against ransomware TTPs.

MITRE ATT&CK Techniques

Crypto24’s Attack Tactics and Techniques

Crypto24 maps to multiple MITRE ATT&CK TTPs, including:

Initial Access (TA0001) via external remote services.
Persistence (TA0003) with malicious Windows services and local accounts.
Defense Evasion (TA0005) by disabling EDR and firewall protections.
Lateral Movement (TA0008) using PSExec and remote tools.
Exfiltration (TA0010) to cloud storage (Google Drive).
Impact (TA0040) with ransomware payload encryption.

Indicators of Compromise (IOCs)

Hashes, Emails, and Malicious Domains

SHA256 Samples – Multiple unique ransomware payload signatures.
Emails – crypto24support[@]pm[.]me, noreply[@]crypto24lab[.]com
TOR Address – j5o5y2feotmhvr7c[…]ad[.]onion
Compromised Domains – palmgold-mgmt.com, cms.law/en/int/, karndean.com, soubeiranchobet.com.ar, larimart.it, arianadx.com.

References

Research Sources on Crypto24 Ransomware

What’s new on HivePro

Get through updates and upcoming events, and more directly in your inbox