crypto24
ransomware group · aka Crypto24, CZ (leak-site branding; used by some trackers) · Unknown; 2025 vendor research reported tooling and procedural overlaps suggesting possible ties to former Black Basta operators (unconfirmed) · active since Late 2024 / early 2025 (initial public tracking; exact date unknown)
Victims · 7d
0flat
Victims · 30d
1active targets
Victims · 90d
1
All-time (tracked)
51since 2025-04-08
Last post
08-31 13:38UTC
Estimated earnings
—public reporting
Profile · glm-5.3-flash · updated
Crypto24 is a ransomware and data-extortion group first publicly tracked in late 2024/early 2025, associated with double-extortion attacks in which stolen data is published on its leak site. Some vendor research published in 2025 reported tooling and procedural overlaps suggesting possible ties to former Black Basta operators, though attribution remains unconfirmed. The group targets large enterprises and institutions across multiple regions, with leak-site victims spanning education and research, healthcare, manufacturing, legal services, technology, and construction. This dashboard has tracked its leak site since 2026-08-31, recording 1 listed victim and a last post on that date, reflecting an intermittent claiming pattern rather than high-volume activity. The group's listing of Qatar Biomedical Research Institute (QBRI) drew attention in Qatar regional threat coverage for 2025-26.
Tactics & tooling
- Double extortion: encrypts victim systems and publishes or threatens to publish stolen data on a leak site
- Selective big-game targeting of large enterprises and institutions, with named leak-site victims across the Americas, Europe, the Middle East, and Asia
- Reported tooling and procedural overlaps with former Black Basta operators in 2025 vendor analyses (unconfirmed)
- Intermittent leak-site cadence with multi-week to multi-month gaps between victim posts (observed in this dashboard's tracking)
- Initial access techniques and affiliate model: not consistently documented in public reporting (unknown)
- No specific exploited vulnerabilities (CVEs) widely attributed to the group in public reporting as of latest available research
Targeted sectors
Education and researchHealthcareManufacturingProfessional services (legal)Technology and softwareEngineering and constructionBusiness process outsourcing (BPO)Energy and power electronics
Notable public victims
Qatar Biomedical Research Institute (QBRI), MRC Prion Unit and Institute of Prion Diseases (UK medical research institute), Katcon Global, Estudio O'Farrell, ActionPower, Rowad Modern Engineering, Yource (Bulgaria and Greece operations), Putnam Precision, Inc., Comprehensive Orthopaedics and Musculoskeletal Care, LLC
Estimated earnings
No public figure.
Leak-site victims51 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| Me*** | · 15d ago | — |
| Qatar Biomedical Research Institute (QBRI) | · Apr 17, 2026 | — |
| Katcon Global | · Apr 2, 2026 | — |
| Industrias Guerra, S.A. | · Apr 2, 2026 | — |
| ActionPower | · Mar 27, 2026 | — |
| Estudio O'Farrell | · Mar 24, 2026 | — |
| Invaccs software technologies pvt ltd | · Mar 10, 2026 | — |
| Comprehensive Orthopaedics and Musculoskeletal Care, LLC | · Mar 9, 2026 | — |
| Rowad Modern Engineering | · Mar 5, 2026 | — |
| Putnam Precision, Inc. | · Feb 9, 2026 | — |
| MRC Prion Unit and Institute of Prion Diseases | · Jan 24, 2026 | — |
| Yource Bulgaria & Greece | · Jan 21, 2026 | — |
| Unified Assessment Platform ExamRoom.AI | · Dec 23, 2025 | — |
| SASP SNCC AUTOMATISME SOLUTIONS PROCESS | · Dec 17, 2025 | — |
| Hollysys Asia Pacific | · Dec 1, 2025 | — |
| Bayu Buana Travel Service | · Nov 15, 2025 | — |
| AsahiKASEI MICRODEVICES | · Nov 12, 2025 | — |
| Meinhardt Group | · Oct 27, 2025 | — |
| Bayu Buana Travel | · Oct 27, 2025 | — |
| Mei *** | · Oct 24, 2025 | — |
| U.S. Vanadium Holding Company LLC | · Oct 21, 2025 | — |
| Banco Hipotecario del Uruguay | · Oct 3, 2025 | — |
| Generali Group | · Sep 18, 2025 | — |
| Palmgold Management Sdn Bhd | · Aug 18, 2025 | — |
| CMS Legal Services EEIG | · Aug 16, 2025 | — |
| Karndean International, LLC | · Aug 15, 2025 | — |
| Kar *** | · Aug 12, 2025 | — |
| SOUBEIRAN CHOBET S.R.L. | · Jul 22, 2025 | — |
| TransCore ITS, LLC | · Jul 20, 2025 | — |
| Sou *** | · Jul 17, 2025 | — |
| Tra *** | · Jul 16, 2025 | — |
| Larimart S.P.A | · Jul 16, 2025 | — |
| Lar *** | · Jul 14, 2025 | — |
| Warisan TC Holdings Berhad | · Jul 10, 2025 | We have exfiltrated over 300GB of sensitive data, including Customer databases (all dbs of wtc - TOURPLAN, CRM, E-INVOICE,...),Legal and HR documents, Financial and employee records, Contractual documents with partners and customers. |
| Tan Chong Motor Holdings Berhad | · Jul 10, 2025 | Data Size: 300GB We have exfiltrated over 300GB of sensitive data, including Customer databases (all dbs of tanchong - NAV, BRASSTAX, VTS, CRM, E-INVOICE,...),Legal and HR documents, Financial and employee records, Contractual documents with partners and customers. |
| A-Qroup Sığorta Şirkəti | · Jul 10, 2025 | Data Size: 730GB The entire InsureAZ database has been leaked — including real insurance documents and all related materials such as medical, auto, and internal corporate records. |
| Artemis Healthcare, Inc | · Jul 10, 2025 | 1TB It contains sensitive personal data, including medical records, official documents, and imaging files of millions of patients, as well as various databases. |
| Sagence AI | · Jul 10, 2025 | Data Size: 2.4TB This leak contains the full TSMC 5nm and 7nm Process Design Kits, UMC 40ULP PDK and FDK, along with confidential AI-related project data from internal R&D, including simulation models, layout files, hardware accelerator designs, and proprietary training architectures, all sourced directly from foundry servers. |
| Tien Tuan Pharmaceutical Machinery Co. Ltd | · Jun 5, 2025 | — |
| FORTÉ | · Jun 5, 2025 | — |
| Choice AG | · May 29, 2025 | — |
| Elite Advanced Laser Corporation ( Elaser ) | · May 28, 2025 | — |
| Elaser | · May 28, 2025 | — |
| N8XT | · Apr 23, 2025 | — |
| CMC Corperation | · Apr 12, 2025 | 2 TB data including Token Data, Database Data, Website Data, ... from MariaDB, MongoDB and RARS-DB etc ... in DataCenter. |
| ModulusGroup,Ludi-SFM | · Apr 11, 2025 | casino customer info, db, ERP data, casino system projects source code and so on. |
| Iris Neofinanciera | · Apr 8, 2025 | iris.com.co 1TB Colombia |
| International Busines Service | · Apr 8, 2025 | ibsns.com 2GB Egypt |
| technoforte software pvt ltd | · Apr 8, 2025 | Technoforte.co.in 30GB India |
| Mochtar Karuwin Komar: Indonesian law firm - MKK | · Apr 8, 2025 | mkklaw.net 700GB Indonesia |
In the newsAll →
Victim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .