crypto24
First seen April 8, 2025Active47 claimed victims
The claims below are reproduced as posted by crypto24 on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Crypto24 is a double-extortion ransomware-as-a-service group that surfaced on the RAMP forum in mid-2024, targeting large organizations in financial services, healthcare, manufacturing, and technology across Asia, Europe, and North America, with notable victims including CMC Group, Vietnam's second-largest ICT conglomerate.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Me*** | August 31, 2026 | ransomlook | — |
| Qatar Biomedical Research Institute (QBRI) | April 17, 2026 | ransomware_live | — |
| Industrias Guerra, S.A. | April 2, 2026 | ransomware_live | — |
| Katcon Global | April 2, 2026 | ransomware_live | — |
| ActionPower | March 27, 2026 | ransomware_live | — |
| Estudio O'Farrell | March 24, 2026 | ransomware_live | — |
| Invaccs software technologies pvt ltd | March 10, 2026 | ransomware_live | — |
| Comprehensive Orthopaedics and Musculoskeletal Care, LLC | March 9, 2026 | ransomware_live | — |
| Rowad Modern Engineering | March 5, 2026 | ransomware_live | — |
| Putnam Precision, Inc. | February 9, 2026 | ransomware_live | — |
| MRC Prion Unit and Institute of Prion Diseases | January 24, 2026 | ransomware_live | — |
| Yource Bulgaria & Greece | December 30, 2025 | ransomware_live | — |
| Unified Assessment Platform ExamRoom.AI | December 23, 2025 | ransomware_live | — |
| SASP SNCC AUTOMATISME SOLUTIONS PROCESS | December 17, 2025 | ransomware_live | — |
| Hollysys Asia Pacific | December 1, 2025 | ransomware_live | — |
| AsahiKASEI MICRODEVICES | November 12, 2025 | ransomware_live | — |
| Bayu Buana Travel | October 27, 2025 | ransomware_live | — |
| Meinhardt Group | October 24, 2025 | ransomware_live | — |
| U.S. Vanadium Holding Company LLC | October 20, 2025 | ransomware_live | — |
| Bayu Buana Travel Service | October 20, 2025 | ransomware_live | — |
| Banco Hipotecario del Uruguay | October 3, 2025 | ransomware_live | — |
| Generali Group | September 18, 2025 | ransomware_live | — |
| Kar *** | August 12, 2025 | ransomware_live | — |
| Palmgold Management Sdn Bhd | August 5, 2025 | ransomware_live | — |
| Karndean International, LLC | July 25, 2025 | ransomware_live | — |
| Sou *** | July 17, 2025 | ransomware_live | — |
| Tra *** | July 16, 2025 | ransomware_live | — |
| Larimart S.P.A | July 15, 2025 | ransomware_live | — |
| SOUBEIRAN CHOBET S.R.L. | July 14, 2025 | ransomware_live | — |
| Warisan TC Holdings Berhad | July 9, 2025 | ransomware_live | — |
| Tan Chong Motor Holdings Berhad | July 9, 2025 | ransomware_live | — |
| A-Qroup Sığorta Şirkəti | June 18, 2025 | ransomware_live | — |
| Artemis Healthcare, Inc | June 18, 2025 | ransomware_live | — |
| FORTÉ | June 5, 2025 | ransomware_live | — |
| Tien Tuan Pharmaceutical Machinery Co. Ltd | June 5, 2025 | ransomware_live | — |
| Choice AG | May 29, 2025 | ransomware_live | — |
| N8XT | April 23, 2025 | ransomware_live | — |
| CMC Corperation | April 12, 2025 | ransomware_live | — |
| ModulusGroup,Ludi-SFM | April 10, 2025 | ransomware_live | — |
| Iris Neofinanciera | April 8, 2025 | ransomware_live | — |
| International Busines Service | April 8, 2025 | ransomware_live | — |
| technoforte software pvt ltd | April 8, 2025 | ransomware_live | — |
| Mochtar Karuwin Komar: Indonesian law firm - MKK | April 8, 2025 | ransomware_live | — |
| Taxplan | April 8, 2025 | ransomware_live | — |
| TransCore ITS, LLC | March 31, 2025 | ransomware_live | — |
| Elite Advanced Laser Corporation ( Elaser ) | March 6, 2025 | ransomware_live | — |
| CMS Legal Services EEIG | December 13, 2023 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).