APT / THREAT GROUP

CryptBot

aliases

Last seen:Mar 17, 2026

Intelligence Profile

A typical infostealer, capable of obtaining credentials for browsers, crypto currency wallets, browser cookies, credit cards, and creates screenshots of the infected system. All stolen data is bundled into a zip-file that is uploaded to the c2.

Threat Analysis

CryptBot is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://any.run/cybersecurity-blog/cryptbot-infostealer-malware-analysis/

→https://asec.ahnlab.com/en/24423/

→https://asec.ahnlab.com/en/26052/

→https://asec.ahnlab.com/en/31683/

→https://asec.ahnlab.com/en/31802/

Quick Facts

TypeAPT / Threat Group

Aliases2

Also Known As

win.cryptbotCryptBot

External Intelligence

Malpedia: win.cryptbot

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search CryptBot