Search Ransomware Intelligence
Jump to a group, country, industry or search victims.
Crypto24
As of Oct 19, 2026, Crypto24 has listed 44 confirmed victims on its leak site since Mar 31, 2025, 0.1% of all victims tracked by Brandefense. Its most targeted country is United States (20.5% of its victims) and its most targeted sector is Consulting.
Crypto24 is a double-extortion ransomware-as-a-service group that surfaced on the RAMP forum in mid-2024, targeting large organizations in financial services, healthcare, manufacturing, and technology across Asia, Europe, and North America, with notable victims including CMC Group, Vietnam's second-largest ICT conglomerate.
Follow and IOC feeds are part of the Brandefense platform.
- Confirmed Victims
- 44
- Rank By Victims
- #112
- Last Leak-Site Post
- Apr 17, 2026
- Top Country
- United States
- Top Sector
- Consulting
Victims Posted Per Month.
| Month | Confirmed victims |
|---|---|
| May 2026 | 0 |
| June 2026 | 0 |
| July 2026 | 0 |
| August 2026 | 0 |
| September 2026 | 0 |
| October 2026 (month in progress) | 0 |
| Month | Confirmed victims |
|---|---|
| November 2025 | 1 |
| December 2025 | 4 |
| January 2026 | 1 |
| February 2026 | 1 |
| March 2026 | 5 |
| April 2026 | 3 |
| May 2026 | 0 |
| June 2026 | 0 |
| July 2026 | 0 |
| August 2026 | 0 |
| September 2026 | 0 |
| October 2026 (month in progress) | 0 |
| Month | Confirmed victims |
|---|---|
| March 2025 | 1 |
| April 2025 | 8 |
| May 2025 | 2 |
| June 2025 | 4 |
| July 2025 | 4 |
| August 2025 | 4 |
| September 2025 | 1 |
| October 2025 | 5 |
| November 2025 | 1 |
| December 2025 | 4 |
| January 2026 | 1 |
| February 2026 | 1 |
| March 2026 | 5 |
| April 2026 | 3 |
| May 2026 | 0 |
| June 2026 | 0 |
| July 2026 | 0 |
| August 2026 | 0 |
| September 2026 | 0 |
| October 2026 (month in progress) | 0 |
Latest Crypto24 Victims.
Search all 44 →| Victim | Country | Industry | Data claimed | Posted |
|---|---|---|---|---|
| Qatar Biomedical Research Institute (QBRI) hbku.edu.qa | QAQatar | Consulting | Not stated | |
| Katcon Global katcon.com | MXMexico | Transportation and Logistics | Not stated | |
| Industrias Guerra, S.A. igsa.es | ESSpain | Education and Research | Not stated | |
| ActionPower actionpowertest.com | CNChina | Technology | Not stated | |
| Estudio O'Farrell estudio-ofarrell.com | ARArgentina | Legal Services | Not stated | |
| Invaccs software technologies pvt ltd invaccs.com | INIndia | Technology | Not stated |
How They Operate.
Crypto24's threat actor profile lists 3 malware and tools, with its targets and related actors.
TTPs, CVEs and malware →Who Crypto24 Targets.
History.
First confirmed victim listed on its leak site
Busiest month on record: 8 confirmed victims
First seen in Brandefense data
Most recent leak-site post
Get Real-Time Alerts, IOC Feeds And Takedowns.
The Brandefense platform watches every leak site for your company, vendors and executives, and acts on what it finds.