Crypto24 Ransomware Group Blends Legitimate Tools with Custom Malware for Stealth Attacks

Introduction

The Crypto24 ransomware group has emerged as one of the most dangerous ransomware operations in recent years. Their campaigns are not “smash and grab” attacks; instead, they represent a stealth-first, hybrid threat model that blends:

• Legitimate IT tools (living-off-the-land techniques) that blend into normal enterprise activity.
• Custom-developed malware modules engineered to disable endpoint defenses (EDR) and ensure persistence.

The result is a highly professional attack model that neutralizes defenses before encryption begins, leaving organizations blind to lateral movement, data theft, and eventual extortion.

Why Crypto24 is Different

Crypto24 reflects three key shifts in modern ransomware:

1. Stealth over speed – they spend days or weeks preparing before triggering encryption.
2. Defense evasion as a priority – disabling EDR and antivirus is a prerequisite, not an afterthought.
3. Hybridization of tactics – borrowing both from criminal ransomware gangs and state-sponsored APT actors.

Detailed Technical Breakdown

Loader / Dropper Stage

• Delivered via spear-phishing attachments, RDP brute force, or stolen credentials.
• Masquerades as:
  • MicrosoftEdgeUpdate.exe
  • OneDriveUpdater.exe
  • WinDefenderService.exe
• Drops secondary payloads into:
  • C:\Program Files (x86)\Microsoft\
  • C:\Users<user>\AppData\Roaming\
• Executes DLL payloads using regsvr32.exe or rundll32.exe.

Persistence:

• Registry keys created under:
  • HKCU\Software\Microsoft\Windows\CurrentVersion\Run\EdgeUpdate
  • HKLM\SYSTEM\CurrentControlSet\Services\WinUpdateSvc

EDR Bypass / Defense Evasion

The core innovation of Crypto24.

Observed behaviors:

• Enumerates installed security software via WMI:

  Get-WmiObject -Namespace "root\SecurityCenter2" -Class AntiVirusProduct

• Kills security processes with taskkill /f /im <process.exe>.
• Deletes security services:

  sc delete <service_name>

• Unloads EDR drivers via NtUnloadDriver API.
• Modifies registry keys under:

  HKLM\SYSTEM\CurrentControlSet\Services\<EDRService>

Process Injection:

• Uses OpenProcess → VirtualAllocEx → WriteProcessMemory → CreateRemoteThread chain.
• Targets explorer.exe and svchost.exe to gain trusted process lineage.

Persistence & Stealth

• Scheduled tasks disguised as OS updates:

  schtasks /create /tn "Windows Update Check" /tr "edgeupdate.exe" /sc minute /mo 30

• Fake services mimicking:
  • WinDefend
  • MicrosoftEdgeUpdate
• DLL sideloading into trusted executables (OneDrive.exe, Microsoft services).
• File timestamps altered to blend with OS install date.

Encryption Engine

• AES-256 CBC for file encryption.
• Keys wrapped in RSA-2048.
• File renaming: .crypto24.
• Ransom notes (README.txt) left in each directory with Tor-based instructions.

📡 Data Exfiltration

• Exfiltrates sensitive data before encryption.
• Compresses files with 7zip or custom packers.
• Uses HTTPS POST or abused cloud services (OneDrive, Dropbox).
• Data staged to attacker C2 disguised as cloud sync traffic.

Mapping to MITRE ATT&CK

Crypto24 aligns with multiple techniques across the kill chain:

• T1078 – Valid Accounts (stolen creds).
• T1059 – Command & Scripting Interpreter (PowerShell).
• T1569 – System Services (PsExec, service creation).
• T1562 – Impair Defenses (EDR/AV tampering).
• T1055 – Process Injection (explorer.exe hijacking).
• T1486 – Data Encrypted for Impact.
• T1041 – Exfiltration Over C2 Channel.

Real-World Impact: Karndean International Case

In one high-profile case, Karndean International was paralyzed by Crypto24:

• Global production downtime.
• Disrupted supply chains.
• Significant reputational harm.

Other victims in logistics, retail, and manufacturing confirm Crypto24’s focus on high-value industries where downtime = immediate financial loss.

Why Detection is Hard

1. Tool overlap: IT admins also use PowerShell, PsExec, WMI daily.
2. EDR blind spots: Once disabled, defenders are blind.
3. Delayed execution: Weeks may pass before detonation.

Defense Recommendations

1. Access Hardening
   • Enforce MFA.
   • Remove exposed RDP endpoints.
   • Rotate credentials.
2. EDR Resilience
   • Deploy EDR with driver self-protection.
   • Enable kernel-mode tamper resistance.
3. Behavioral Analytics
   • Alert when PsExec or PowerShell appear outside patching windows.
   • Monitor child-process anomalies (e.g., explorer.exe → powershell.exe).
4. Network Segmentation
   • Isolate crown jewel systems.
   • Restrict lateral movement.
5. Threat Hunting
   • Search for persistence artifacts: fake services, scheduled tasks, Run keys.
6. Resilient Backups
   • Maintain offline backups.
   • Regularly test disaster recovery playbooks.

The Hybrid Threat Model: The Future of Ransomware

Crypto24 embodies a new hybrid model of cybercrime:

• Hybrid toolset: Legitimate IT tools + custom malware.
• Hybrid operations: Affiliates, developers, negotiators.
• Hybrid goals: Financial extortion + espionage-style stealth.

This shows ransomware is evolving closer to APT-grade operations, blurring the line between state-sponsored attacks and cybercrime.

Conclusion

Crypto24 represents the next generation of ransomware: stealthy, persistent, and professional. By disabling defenses and blending with IT operations, they deliver maximum disruption while staying under the radar.

For defenders, this is a wake-up call: signature-based detection is no longer enough. Only organizations that combine layered defenses, proactive hunting, and adaptive resilience will survive this new era of ransomware.

References

• Trend Micro. Crypto24 Ransomware Group Blends Legitimate Tools with Custom Malware for Stealth Attacks.
• SOC Prime. Crypto24 Ransomware Detection: Hackers Hit Large Organizations via Legitimate Tools and Custom Malware.
• Industrial Cyber. Crypto24 Ransomware Blends Legitimate Tools with Custom Malware to Strike Manufacturing.
• Intertec Systems. Crypto24 Ransomware Attacks Disable EDR with Custom Tools.
• DeXpose. Crypto24 Ransomware Strikes Karndean International.
• ransomware.live. Crypto24 Ransomware Group.