CryptoMix

aliases

Last seen:Mar 17, 2026

Intelligence Profile

A variant of CryptoMix is win.clop.

Threat Analysis

CryptoMix is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→http://www.nyxbone.com/malware/CryptoMix.html

→https://www.cert.pl/en/news/single/technical-analysis-of-cryptomixcryptfile2-ransomware/

→https://twitter.com/JakubKroustek/status/804009831518572544

→https://www.bleepingcomputer.com/news/security/new-empty-cryptomix-ransomware-variant-released/

→https://www.bleepingcomputer.com/news/security/0000-cryptomix-ransomware-variant-released/

→https://www.bleepingcomputer.com/news/security/xzzx-cryptomix-ransomware-variant-released/

→https://www.bleepingcomputer.com/news/security/test-cryptomix-ransomware-variant-released/

→https://www.bleepingcomputer.com/news/security/work-cryptomix-ransomware-variant-released/

→https://www.bleepingcomputer.com/news/security/system-cryptomix-ransomware-variant-released/

→https://www.bleepingcomputer.com/news/security/mole66-cryptomix-ransomware-variant-released/

Quick Facts

TypeAPT / Threat Group

Aliases5

Also Known As

win.cryptomixCryptoMixAzerCryptFile2Zeta

External Intelligence

Malpedia: win.cryptomix

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search CryptoMix