crpx0Malware
Last reported 1 month ago, by AhnLab ASEC5 reports
ATT&CK techniques
1 technique · each with the sentence it comes from- T1027.006HTML Smuggling
“…s such as JS, VBE, VBS, BAT, and HTA, as well as web document formats like HTML, HTM, and SHTML, the distribution of phishing pages, HTML smuggling, and the exploitation of LOLBins stood out.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
5 reports, newest first · the exact sentence from each-
August 2026 Threat Trend Report on Ransomware“In August 2026, major groups such as The Gentlemen, Qilin, CL0P (Clop), Gunra, CRPx0, DragonForce, Orova, FulcrumSec, Emperador, and Helix continued their activities.”
-
Security Issues in the Korean & Global Financial Sector in August 2026“Ransomware groups such as CRPx0, Dysphor1A, LockBit 5.0, And LockBit targeted the financial sector and posted victims on DLS (Dedicated Leak Sites, public extortion sites).”
-
Risky Bulletin: Dutch intel services to get extensive new powers“CRPx0 ransomware: Ransom-ISAC members have published a technical report on CRPx0, a new ransomware strain currently distributed through ClickFix campaigns.”
-
July 2026 Ransomware Trend Report“…while new data-stealing and ransomware groups—including Gammax, SECTION9, ExfilSquad, Shiba, GLOBAL SECRET GROUP, D1R, The Crypt Apados, CRPx0, and Doommageddon also emerged as new data theft and ransomware groups.”
-
Ransomware Surges in July After Q2 Lull“The next most active group was DragonForce, making up 41 attacks, followed by INC (36), CRPx0 (33) and SafePay (30).”
Indicators in its reports
named in the reports above- nitter[.]netin 1 report
- xcancel[.]comin 1 report
- patak[.]catin 1 report
- micahflee[.]comin 1 report
- jillian.bsky[.]socialin 1 report
- reason[.]comin 1 report
- evangreer.bsky[.]socialin 1 report
- marktsec.bsky[.]socialin 1 report
- bankofbaroda[.]inin 1 report
- qnbfinansbank[.]comin 1 report
- allianz.co[.]thin 1 report
Copy these 11 indicators · defanged
Thanks — we review every report.