A New Threat: Unmasking Crypto24 Ransomware’s Stealthy Toolkit

Trend Micro’s latest research sheds light on Crypto24, a highly coordinated ransomware operation that blends legitimate administrative tools, advanced evasion techniques, and custom malware to infiltrate, persist, and steal from its victims before encrypting their systems. The group has been active against financial services, manufacturing, entertainment, and technology sectors across Asia, Europe, and the USA.

“Our analysis reveals that the threat actor operates with a high level of coordination, frequently launching attacks during off-peak hours to evade detection and maximize impact,” the report states.

Crypto24 operators rely on a hybrid toolkit, using both legitimate IT utilities and purpose-built malicious payloads. Commonly abused tools include PSExec for lateral movement, AnyDesk for persistent remote access, and Google Drive for covert data exfiltration.

They also deploy keyloggers for credential harvesting and custom backdoors, while leveraging “a customized version of RealBlindingEDR” to disable endpoint protection. This variant is designed to selectively target security products from over two dozen vendors, including Trend Micro, Microsoft, Symantec, Kaspersky, and Fortinet.

Persistence is achieved through a mix of scheduled tasks, malicious Windows services, and privileged account creation. Trend Micro observed attackers reactivating default administrator accounts, creating generically named user accounts, and assigning them to both the Administrators and Remote Desktop Users groups.

Privilege escalation is then carried out using runas.exe and PSExec, enabling execution of commands under higher-privileged contexts.

A hallmark of Crypto24’s campaign is its targeted dismantling of security controls. Trend Micro notes:

“What we observed represents a classic example of ‘living off the land’ tactics, where threat actors leverage legitimate administrative tools to further their attacks in post-compromise scenarios.”

In one case, the attackers abused gpscript.exe, a legitimate Group Policy utility, to remotely execute Trend Vision One’s uninstaller after obtaining administrator privileges.

Crypto24’s surveillance phase is meticulous. The deployed keylogger (WinMainSvc.dll) is configured to run only when hosted by svchost.exe—a tactic to evade sandbox analysis—and sends captured keystrokes, along with active window titles, to Google Drive. Before exfiltration, the ransomware tests its upload capability by sending a “Test.txt” file containing the word “Test”.

After mapping the network, stealing credentials, and disabling defenses, the operators deploy the MSRuntime.dll ransomware payload. In some observed incidents, initial execution failed due to Trend Micro detection, prompting the attackers to remove EDR components before successfully encrypting files and leaving ransom instructions.

Trend Micro emphasizes that Crypto24 “demonstrates a clear understanding of enterprise defense stacks and an ability to circumvent them.” This operational maturity, coupled with the blending of legitimate and malicious tools, makes detection challenging and prolongs dwell time before the final payload is delivered.

Related Posts:

• Pro-Russian Threat Actors Launch Coordinated DDoS Attacks Against Japanese Organizations
• North Korean Cyberattacks Persist: Developers Targeted via npm
• China-Linked Phishing Campaign Exploits Geopolitical Tensions, Ravages Asian Finance Sector
• Premium Panel Phishing Toolkit Exposed: Two Years of Global Attacks