// THREAT ACTOR

CRYP70N1C0D3_

Active

CRYP70N1C0D3 is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem — file encryption combined with the threat of stolen-data publication on a public leak site — and continues to post fresh victim claims as part of an ongoing extortion campaign.

For Ransomnews editorial coverage of CRYP70N1C0D3 — incident write-ups, attribution notes, and additional context — see the Threat Groups archive or run a site search.

12 Victims tracked

1 / 1 Active mirrors

2021-12-18 First listing

2022-03-07 Most recent

Victims by year

2022 1
2021 11

Leak site mirrors

1 mirror tracked, 1 currently reachable. These are criminal-infrastructure URLs — links are deliberately not provided.

7k4yyskpz3rxq5nyokf6ztbpywzbjtdfanweup3skctcxopmt7tq7eid.onion |*| CRYP70N1C0D3 Team |*| snapshot · 2026-08-06 21:37

Recent victims

The 50 most recent victims claimed by CRYP70N1C0D3. Total in the index: 12.

Date listed	Victim	Description
2022-03-07	CLOSE
2021-12-18	iima.ac.in
2021-12-18	hislopcollege.ac.in
2021-12-18	oppodigital.in
2021-12-18	nals.in
2021-12-18	albatross.co.in
2021-12-18	suriyanar.com
2021-12-18	shinyoko-porno.com
2021-12-18	toxicsites.us
2021-12-18	antistatik-esd-cozumler.com.tr
2021-12-18	paknavy.gov.pk
2021-12-18	vaja.ir

← Back to Ransomtracker

Statistics on this page are computed by Ransomnews from a live leak-site monitoring feed. Numbers update every ten minutes. Operator-written victim descriptions are truncated and shown in snippet form only. Source data: RansomLook (CC BY 4.0), aggregated and adapted by Ransomnews.