// THREAT ACTOR
CRYPTO24_
DormantCRYPTO24 is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem — file encryption combined with the threat of stolen-data publication on a public leak site — and continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of CRYPTO24 — incident write-ups, attribution notes, and additional context — see the Threat Groups archive or run a site search.
Victims by year
- 2026 11
- 2025 39
Leak site mirrors
2 mirrors tracked, 0 currently reachable. These are criminal-infrastructure URLs — links are deliberately not provided.
-
j5o5y2feotmhvr7cbcp2j2ewayv5mn5zenl3joqwx67gtfchhezjznad.onionCRYPTO24 | Data Leak Site snapshot · 2026-08-19 21:06 -
j5o5y2feotmhvr7cbcp2j2ewayv5mn5zenl3joqwx67gtfchhezjznad.onionsnapshot · 2025-05-03 01:14
Recent victims
The 50 most recent victims claimed by CRYPTO24. Total in the index: 50.
| Date listed | Victim | Description |
|---|---|---|
| 2026-04-17 | Qatar Biomedical Research Institute (QBRI) | |
| 2026-04-02 | Katcon Global | |
| 2026-04-02 | Industrias Guerra, S.A. | |
| 2026-03-27 | ActionPower | |
| 2026-03-24 | Estudio O'Farrell | |
| 2026-03-10 | Invaccs software technologies pvt ltd | |
| 2026-03-09 | Comprehensive Orthopaedics and Musculoskeletal Care, LLC | |
| 2026-03-05 | Rowad Modern Engineering | |
| 2026-02-09 | Putnam Precision, Inc. | |
| 2026-01-24 | MRC Prion Unit and Institute of Prion Diseases | |
| 2026-01-21 | Yource Bulgaria & Greece | |
| 2025-12-23 | Unified Assessment Platform ExamRoom.AI | |
| 2025-12-17 | SASP SNCC AUTOMATISME SOLUTIONS PROCESS | |
| 2025-12-01 | Hollysys Asia Pacific | |
| 2025-11-15 | Bayu Buana Travel Service | |
| 2025-11-12 | AsahiKASEI MICRODEVICES | |
| 2025-10-27 | Meinhardt Group | |
| 2025-10-27 | Bayu Buana Travel | |
| 2025-10-24 | Mei *** | |
| 2025-10-21 | U.S. Vanadium Holding Company LLC | |
| 2025-10-03 | Banco Hipotecario del Uruguay | |
| 2025-09-18 | Generali Group | |
| 2025-08-18 | Palmgold Management Sdn Bhd | |
| 2025-08-16 | CMS Legal Services EEIG | |
| 2025-08-15 | Karndean International, LLC | |
| 2025-08-12 | Kar *** | |
| 2025-07-22 | SOUBEIRAN CHOBET S.R.L. | |
| 2025-07-20 | TransCore ITS, LLC | |
| 2025-07-17 | Sou *** | |
| 2025-07-16 | Tra *** | |
| 2025-07-16 | Larimart S.P.A | |
| 2025-07-14 | Lar *** | |
| 2025-07-10 | Warisan TC Holdings Berhad | We have exfiltrated over 300GB of sensitive data, including Customer d… |
| 2025-07-10 | Tan Chong Motor Holdings Berhad | Data Size: 300GB We have exfiltrated over 300GB of sensitive data, … |
| 2025-07-10 | A-Qroup Sığorta Şirkəti | Data Size: 730GB The entire InsureAZ database has been leaked — inc… |
| 2025-07-10 | Artemis Healthcare, Inc | 1TB It contains sensitive personal data, including medical records,… |
| 2025-07-10 | Sagence AI | Data Size: 2.4TB This leak contains the full TSMC 5nm and 7nm Proce… |
| 2025-06-05 | Tien Tuan Pharmaceutical Machinery Co. Ltd | |
| 2025-06-05 | FORTÉ | |
| 2025-05-29 | Choice AG | |
| 2025-05-28 | Elite Advanced Laser Corporation ( Elaser ) | |
| 2025-05-28 | Elaser | |
| 2025-04-23 | N8XT | |
| 2025-04-12 | CMC Corperation | 2 TB data including Token Data, Database Data, Website Data, ... from … |
| 2025-04-11 | ModulusGroup,Ludi-SFM | casino customer info, db, ERP data, casino system projects source code… |
| 2025-04-08 | Iris Neofinanciera | iris.com.co 1TB Colombia |
| 2025-04-08 | International Busines Service | ibsns.com 2GB Egypt |
| 2025-04-08 | technoforte software pvt ltd | Technoforte.co.in 30GB India |
| 2025-04-08 | Mochtar Karuwin Komar: Indonesian law firm - MKK | mkklaw.net 700GB Indonesia |
| 2025-04-08 | Taxplan | taxplann.ca 856.4GB Canada |
// CONFIRMED ATTACKS
Crypto24 confirmed attacks: 6 verified incidents
Ransomnews has verified 6 Crypto24 incidents against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. The confirmed record runs from April 2025 to May 2026. United States accounts for 2 of them (33%), with victims recorded in 5 countries in total. The most affected sector is manufacturing, at 2 confirmed victims. Where a figure was disclosed (2 cases), these incidents account for 47,511 exposed records.
Confirmed victims by year
Most affected sectors
Most affected countries
Verified Crypto24 incidents
| Date | Organisation | Sector | Location | Records | Ransom paid | Source |
|---|---|---|---|---|---|---|
| May 2026 | Notin.es | Technology | Madrid, Spain | — | Unknown | Source |
| September 2025 | Banco Hipotecario del Uruguay | Finance | Montevideo, Uruguay | — | Unknown | Source |
| July 2025 | Karndean Designflooring USA | Manufacturing | Pennsylvania, United States | 1,644 | Unknown | Source |
| June 2025 | Larimart SPA | Manufacturing | Rome, Italy | — | Unknown | Source |
| May 2025 | Artemis Healthcare, Inc. | Healthcare | Utah, United States | 45,867 | Unknown | Source |
| April 2025 | CMC Corporation | Technology | Hanoi, Vietnam | — | Unknown | Source |
Claimed vs confirmed. The figures above the fold on this page come from Crypto24's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design — most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.