Threat Intelligence Report November 18 - November 24 2025

Crypto24 Ransomware

The Red Piranha threat intelligence team continues to track ransomware operators across leak sites, dark-web forums, and open-source feeds. During recent weeks, Crypto24 has emerged as a technically sophisticated double-extortion operator targeting large enterprises across Asia, Europe, and North America.

Crypto24 primarily goes after financial services, manufacturing, entertainment, technology and healthcare organisations with substantial data assets and low tolerance for downtime. Attacks are typically staged during nights/weekends and combine “living off the land” with custom EDR-bypass malware, stealthy data theft and then wide-scale encryption using the “.crypto24” extension and “Decryption.txt” ransom note.

Detailed TTPs (Narrative View)

Below is a compact, operator-centric view of Crypto24’s attack flow:

1. External Footprinting & Target Selection

• Scan for exposed RDP/VPN and other remote admin services.
• Prioritise enterprises with large data footprint and visible OT/ERP/backup infrastructure.
  
  

2. Initial Access – Valid Accounts & Remote Services

• Use compromised, purchased or recycled credentials to log into RDP/VPN.
• Reactivate default or dormant admin accounts to avoid noisy brute-force.
  
  

3. Foothold Stabilisation & Persistence

• Create/enable local admin users with innocuous names and add them to Administrators/Remote Desktop Users.
• Deploy malicious services (e.g. WinMainSvc, MSRuntime) running under svchost.exe to load keylogger and loaders on boot.
• Set scheduled tasks pointing to scripts in %ProgramData%\Update\ to guarantee execution even after partial cleanup.
  
  

4. Privilege Escalation & Lateral Movement

• Escalate via UAC bypass (CMSTPLUA interface), runas.exe, and PsExec with stolen admin credentials.
• Enable and harden RDP for operator use (patch termsrv.dll for multiple sessions, add RDP users, relax restrictions).
  
  

5. Defence Evasion & EDR Bypass

• Run RealBlindingEDR to kill/cripple AV/EDR drivers and tamper with hooks.
• Abuse gpscript.exe (signed binary) to invoke vendor uninstallers (e.g. Trend Micro agent remover) and remove endpoint protection.
• Masquerade malware as “Microsoft Runtime Manager” or similar benign-sounding services; aggressively delete logs and self-remove payloads post-encryption.
  
  

6. Credential Access & Monitoring

• Load WinMainSvc.dll as a service to record keystrokes (including control keys).
• Harvest credentials for domain admins, backup systems, and critical line-of-business apps, enabling further lateral movement and future re-entry.
  
  

7. Discovery & Environment Mapping

• Use WMIC and batch scripts (e.g. 1.bat) to dump OS version, hardware, disks, processes, and services.
• Enumerate users and groups via net user / net localgroup.
• Probe reachable hosts and shares to identify file servers, databases, backup targets and high-value data.
  
  

8. Data Collection & Exfiltration (Double-Extortion Setup)

• Aggregate sensitive data (DB dumps, file shares, documentation) into staging paths.
• Use Google Drive API or similar cloud services for exfiltration, hiding in normal HTTPS SaaS traffic.
• In some cases, hundreds of GB of data are uploaded before any encryption begins.
  
  

9. Pre-Encryption Kill Chain & Tool Removal

• Kill database, backup and high-lock processes to ensure maximum encryption coverage.
• Stop or uninstall security agents and scheduled backups where possible.
  
  

10. Ransomware Deployment & Impact

• Launch the Crypto24 encryptor across key systems, typically from already-persistent services or PsExec.
• Append “.crypto24” to encrypted files and drop “Decryption.txt” ransom notes across directories.
• Direct victims to contact addresses and a Tor leak site; threaten data dumps if payment is refused.

MITRE ATT&CK TTP Mapping

Indicators of Compromise (IoCs)

File extension: crypto24 on encrypted files.

Historical / earlier variant: [email protected]

Domains Linked to Campaigns

Mitigations – Crystal Eye XDR 5.5

• Lock down RDP/VPN
  Only allow RDP over VPN, enforce MFA on all admin/VPN accounts, and geo-block/ACL access to known management IPs.
• Control admin accounts hard
  Disable default/dormant admins, review local/domain admin groups regularly, and alert on any new privileged account creation.
• Block EDR tampering and LOLBins
  Use CEASR / app-control to block gpscript.exe, PsExec and unknown binaries from %ProgramData% and temp paths; alert on AV/EDR service stops/uninstalls.
• Segment and isolate critical assets
  Put DCs, file servers, DBs and backup servers in separate zones; restrict SMB/RDP laterals between segments to only what’s absolutely required.
• Protect backups from ransomware
  Keep backups in isolated networks or immutable storage; no interactive logon, no direct RDP/SMB from user LAN; regularly test restores.
• Monitor exfil and Tor/cloud abuse
  Use SWG/SIEM to detect large HTTPS uploads (Google Drive, etc.) from servers; block Tor traffic and alert on any attempt to reach .onion gateways.
• Harden endpoints and logging
  Enforce Defender/EDR tamper protection, block shadow copy deletion (vssadmin, wmic patterns), and enable forensic logging/PCAP on key servers.
• Have a Crypto24-style IR playbook ready
  On detection: isolate hosts via CE, push IoC blocklists (hashes, IPs, emails), rotate privileged creds, and restore only after re-hardening and clean verification.

Ransomware Victims Worldwide

The United States accounted for 55.5% of all reported ransomware victims this week, maintaining an overwhelming lead as the most targeted nation globally. This reflects sustained large-scale campaigns against U.S. enterprises, critical services, and high-value sectors that continue to offer attackers strong financial leverage.

Canada (5.24%) and Mexico (2.62%) followed as significant regional hotspots, highlighting an extended concentration of activity across North America. Japan (2.62%) and the United Kingdom (2.09%) also registered elevated targeting, reinforcing continued adversary pressure on major G7 economies.

A broad mid-tier cluster included India (3.14%), Australia (1.57%), Thailand (1.57%), Sweden (1.57%), Brazil (1.57%), Switzerland (1.57%), and Saudi Arabia (1.57%)—each showing consistent victimisation across critical and commercial sectors. Additional nations such as France (1.05%), Italy (1.05%), Germany (1.05%), South Korea (1.05%), Malaysia (1.05%), United Arab Emirates (1.05%), Sri Lanka (1.05%), Kuwait (1.05%), and Pakistan (1.05%) reflected distributed targeting across Europe, the Middle East, and Asia.

Smaller but meaningful single-incident activity appeared across Barbados, Bolivia, Ireland, China, Netherlands, Oman, Peru, Portugal, Singapore, Slovenia, Uruguay, Colombia, Trinidad & Tobago, Réunion, IGT, and others. Though individually limited, these events underscore the wide geographic scatter of modern ransomware operations.