CRPx0 hacking service for dummies claims victim count more than quintupled

CRPx0, a cybercrime group, has experienced a significant increase in victims, rising from fewer than ten in June to forty-eight organizations by the time of publication. This ransomware and crypto-theft business, which emerged as a scam service earlier in the summer, offers a variety of hacking services, including complete database extraction, network compromise, and persistent access.

The group provides a hacking platform that allows affiliates to keep 100% of their profits, along with a white-label ransomware-as-a-service service for a $10,000 one-time fee. Payment for extortion is requested in Monero, and the group prefers not to target organizations in the Commonwealth of Independent States. CRPx0's ransomware delivery employs two phishing lures - a fake Windows Update and a fake Google reCAPTCHA - to trick victims into executing a PowerShell command, ultimately deploying Python-based ransomware.

The group's advanced control center can be operated by non-technical individuals, stealing valuable files, credentials, and wallet recovery keys while watching stolen cryptocurrency wallet addresses flow in. Defenders should prioritize five actions to protect against CRPx0 and similar attacks: removing the Run dialog for standard users, restricting Terminal via MDM for non-technical staff, alerting on PowerShell, curl, or long base64 strings in the RunMRU, and blocking adversary network indicators.