Crypto24 ransomware

Who Crypto24 is

Crypto24 is a double-extortion ransomware-as-a-service group that surfaced on the RAMP forum in mid-2024, targeting large organizations in financial services, healthcare, manufacturing, and technology across Asia, Europe, and North America, with notable victims including CMC Group, Vietnam's second-largest ICT conglomerate.

Recorded activity

Disclosures attributed to Crypto24 in this database run from April 2025 to August 2026, totalling 47 victims — 0.2% of everything tracked here. Crypto24 has listed victims in 24 countries in this database, most often United States, followed by Singapore and Malaysia. The sectors appearing most in its listings are Technology, Manufacturing, Business Services.

Indicators of compromise

• 45.63.9.192:5050
• [email protected]

Showing a sample of 1 IP, 1 EMAIL on file. Hashes and network indicators published for Crypto24. Leak-site addresses are deliberately excluded. Indicators age quickly — treat a match as a starting point for investigation, and an absence of matches as no assurance.

YARA detection rules

/*
crypto24 ransomware
*/

rule crypto24_Ransomnote
{
    meta:
        author = "ransomware.live"
        family = "ransomware.crypto24"
        description = "Detects crypto24 ransomware ransom note or artifact"
        date = "2026-05-04"
        severity = 7
        score = 70

    strings:
        $name1 = "crypto24" ascii nocase
        $name2 = "CRYPTO24" ascii
        $onion  = "crypto24.onion" ascii nocase

    condition:
        any of them
}

Community-contributed rules for Crypto24, reproduced as published. Test them against your own corpus before relying on them: rule quality and false-positive behaviour vary by author.