Cring

About Cring.

Cring is one of multiple identities used by the Ghost ransomware group, a China-based cybercriminal operation active since early 2021. The group has been known to rotate its ransomware executable payloads, switch file extensions, and modify ransom note text, leading to variable attribution under numerous names including Ghost, Cring, Crypt3r, Phantom, Strike, Hello, Wickrme, HsHarada, and Rapture. Ghost actors conduct widespread attacks for financial gain, targeting organizations across more than 70 countries. Affected sectors include critical infrastructure, education, healthcare, government, religious institutions, technology, and manufacturing, with a notable focus on small- and medium-sized businesses. Initial access is typically gained by exploiting known vulnerabilities in internet-facing systems, including Fortinet FortiOS (CVE-), Adobe ColdFusion (CVE-2010-2861, CVE-2009-3960), Microsoft SharePoint (CVE-2019-0604), and Microsoft Exchange ProxyShell (CVE-, CVE-, CVE-). Following exploitation, the group deploys web shells, downloads Cobalt Strike Beacon, and uses tools such as Mimikatz and BadPotato for credential harvesting and privilege escalation.