CRPx0 hacking service for dummies claims victim count more than quintupled
It's 'built to be operated by a human with no technical background'
CRPx0, a cybercrime gang, has rapidly transformed from a scam service to offering ransomware and crypto theft. The group's victim count skyrocketed from fewer than 10 in June to 48 organizations at the time of this report. CRPx0 provides a hacking service and a "complete database extraction" offering, along with optional public leak coordination.
They also deploy ransomware, enabling affiliates to customize their ClickFix payload delivery using fake Windows Update and Google reCAPTCHA lures. The ransomware, a Python script, steals files and encrypts them using AES-128-CBC (Fernet). CRPx0 operates from the Commonwealth of Independent States (CIS) member countries and prefers Monero (XMR) payments.
The group recently released a v3.0 update, adding a complete offensive control center for managing compromised remote machines. To defend against CRPx0 and similar ransomware tactics, defenders should remove the Run dialog for standard users, restrict Terminal via MDM for non-technical staff, monitor RunMRU writes containing PowerShell and Curl commands, and block adversary network indicators.
Written by urgent.news from The Register Science's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
