Skip to content
brandefense.io
Request A Demo

Search Ransomware Intelligence

Jump to a group, country, industry or search victims.

Inactive · #245 by victimsRansomware group

CrazyHunter

As of Oct 19, 2026, CrazyHunter has listed 7 confirmed victims on its leak site since Mar 5, 2025, 0.0% of all victims tracked by Brandefense. Its most targeted country is Taiwan (71.4% of its victims) and its most targeted sector is Technology.

CrazyHunter is a Go-based ransomware group that emerged in early 2025, derived from the open-source Prince encryptor, exclusively targeting Taiwanese organizations in healthcare, education, and industrial sectors using BYOVD techniques and tools like SharpGPOAbuse for lateral movement.

Is My Company Listed?Follow CrazyHunterRequest IOC Feed

Follow and IOC feeds are part of the Brandefense platform.

Confirmed Victims
7
Rank By Victims
#245
Last Leak-Site Post
Mar 30, 2025
Top Country
Taiwan
Top Sector
Technology

Victims Posted Per Month.

CrazyHunter confirmed victims per month
MonthConfirmed victims
March 20257
April 20250
May 20250
June 20250
July 20250
August 20250
September 20250
October 20250
November 20250
December 20250
January 20260
February 20260
March 20260
April 20260
May 20260
June 20260
July 20260
August 20260
September 20260
October 2026 (month in progress)0
Updated continuously · figures as of Oct 19, 2026

Latest CrazyHunter Victims.

Search all 7 →
Latest confirmed leak-site victims claimed by CrazyHunter
VictimCountryIndustryData claimedPosted
Zuni Data
zunidata.com
USUnited StatesUnknownNot stated
Analog Integrations Corporation
analog.com.tw
TWTaiwanTechnologyNot stated
Netronix Inc
netronixinc.com
TWTaiwanTechnologyNot stated
KD Panels
kdpanels.com
USUnited StatesUnknownNot stated
Huacheng Electric
huachengsz.com
TWTaiwanUnknownNot stated
Mackay Hospital
mmh.org.tw
TWTaiwanHealthcareNot stated

MITRE ATT&CK.

27 techniques across 10 tactics
Initial Access6
Execution9
  • T1021
    Remote Services
  • T1055
    Process Injection
  • T1059.003
    Command and Scripting Interpreter: Windows Command Shell
  • T1072
    Software Deployment Tools
  • T1105
    Ingress Tool Transfer
  • T1211
    Exploitation for Stealth
  • T1569.002
    System Services: Service Execution
  • T1570
    Lateral Tool Transfer
  • T1574.006
    Hijack Execution Flow: Dynamic Linker Hijacking
Persistence3
  • T1484.001
    Domain or Tenant Policy Modification: Group Policy Modification
  • T1543.003
    Create or Modify System Process: Windows Service
  • T1547
    Boot or Logon Autostart Execution
Privilege Escalation1
  • T1068
    Exploitation for Privilege Escalation
Defense Evasion3
  • T1027
    Obfuscated Files or Information
  • T1070
    Indicator Removal
  • T1562.001
    Impair Defenses: Disable or Modify Tools
Discovery1
  • T1083
    File and Directory Discovery
Collection1
  • T1005
    Data from Local System
Command and Control1
  • T1071
    Application Layer Protocol
Exfiltration1
  • T1048
    Exfiltration Over Alternative Protocol
Impact1
  • T1486
    Data Encrypted for Impact
MITRE ATT&CK® technique names © The MITRE Corporation, reproduced with permission.

Arsenal.

  • CrazyHunterMalware
  • Prince ransomwareMalware

Indicators Of Compromise.

10 indicators tracked by Brandefense
  • Hash2bbc6b9dd5e6d0327250b32305be20c89b19b56d33a096522ee33f22d8c82ff1
  • Hashbdfc66266a2a19fc3d5dccef3eefe4c0ee928ba5b7abad60bc320218b2082fea
Full indicator feedGet every indicator for CrazyHunter on the Brandefense platform.Request A Demo
Samples are defanged so they cannot be opened by accident.
Threat intelligence updated Oct 19, 2026.

Who CrazyHunter Targets.

Sectors

  1. Technology228.6%
  2. Education and Research114.3%
  3. Healthcare114.3%

Countries

  1. TWTaiwan571.4%
  2. USUnited States228.6%
Shares are of this group's confirmed victims.

History.


  1. Busiest month on record: 7 confirmed victims

  2. First confirmed victim listed on its leak site

  3. First seen in Brandefense data

  4. Most recent leak-site post

Get Real-Time Alerts, IOC Feeds And Takedowns.

The Brandefense platform watches every leak site for your company, vendors and executives, and acts on what it finds.

Request A Demo

Figures as of Oct 19, 2026. Confirmed leak-site claims collected by Brandefense technologies and validated by Brandefense analysts.

Listed on a leak site means a ransomware group has claimed the company; it is not a confirmed breach. To request a correction or removal, contact Brandefense.