APT / THREAT GROUP

Crylock

aliases

Intelligence Profile

Crylock — tracked by MISP Galaxy (ransomware).

Threat Analysis

Crylock is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://bartblaze.blogspot.com/2016/02/vipasana-ransomware-new-ransom-on-block.html

→https://blog.checkpoint.com/2015/11/04/offline-ransomware-encrypts-your-data-without-cc-communication/

→https://hackmag.com/security/ransomware-russian-style/

→https://ke-la.com/the-ideal-ransomware-victim-what-attackers-are-looking-for/

→https://securelist.com/cis-ransomware/104452/

→https://securelist.com/the-return-of-fantomas-or-how-we-deciphered-cryakl/86511/

→https://securelist.ru/shifrovalshhik-cryakl-ili-fantomas-razbushevalsya/24070/

→https://twitter.com/albertzsigovits/status/1217866089964679174

→https://twitter.com/bartblaze/status/1305197264332369920

→https://twitter.com/demonslay335/status/971164798376468481

Quick Facts

TypeAPT / Threat Group

Aliases2

Also Known As

CryaklCrylock

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search Crylock