Emergence of a New Threat: Crypto24 Ransomware Demonstrates a New Level of Sophistication and Danger
A new threat actor named Crypto24 is currently drawing the attention of cybersecurity researchers worldwide, after demonstrating highly advanced capabilities for bypassing defense systems. Although first observed in 2024, the group has become particularly active and impactful in recent months, successfully bypassing EDR (Endpoint Detection and Response) systems from leading vendors, including Trend Micro.
The attackers utilize legitimate tools such as PSExec and AnyDesk for remote access and lateral movement within corporate networks, as well as services like Google Drive for data exfiltration. The attacks primarily target large organizations in Asia, Europe, and the United States, specifically within the finance, manufacturing, technology, and entertainment sectors. Indicators suggest that this is an organized, patient, and strategically minded threat group, rather than an opportunistic or amateur operation.
Sophisticated Use of Legitimate Tools: Attacks via Existing Organizational Infrastructure
One of the primary methods employed by the Crypto24 group is the “Living off the Land” technique—using legitimate tools already present in the system to advance the attack. For example, the group utilized Trend Micro’s XBCUninstaller.exe tool, designed for removing the company’s software components, to disable the Trend Vision One defense system.
The deliberate and sophisticated use of enterprise tools indicates a deep understanding of the victim’s organizational structure and a capacity for pre-planned maneuvers. The attackers do not act rashly; they execute each stage only after meticulous preparation and a thorough understanding of the system environment. This phase allows them to remove defenses, move between devices, and lay the groundwork for file encryption. These attacks illustrate a shift in approach: less reliance on aggressive malware and greater exploitation of internal infrastructure and systemic trust.
EDR Solutions Under Direct Attack: RealBlindingEDR as a Powerful Disruptive Tool
The most concerning aspect of the Crypto24 attacks is the use of a customized version of “RealBlindingEDR,” which successfully disrupts the defense mechanisms of nearly 30 security vendors, including Cisco, Kaspersky, Malwarebytes, Sophos, and others. According to Trend Micro, the tool successfully hooks security software calls and neutralizes them without triggering immediate suspicion.
This means that even advanced systems may fall victim if organizations do not strictly manage and block dangerous components in advance. The fact that the tool operates against such a wide range of security software highlights an exceptional level of research and technical capability on the part of the attackers.
Recommendations from IPV Security Experts:
* Enable Anti-Tampering Mechanisms: Ensure that local users cannot remove or modify security software on endpoints.
* Restrict Remote Access Tools: Limit the use of tools such as RDP or AnyDesk; permit usage only for authorized systems and users under strict access control.
* Regularly Audit User Permissions: Remove unnecessary privileges and implement the principle of “Least Privilege,” granting users or processes only the minimum permissions required to perform a specific task.
* Enable Self-Protection in Security Agents: This prevents malware and hostile tools from removing the defense software from the system.
* Increase Awareness Among IT Teams and Senior Management: It is vital they understand the risks associated with the use of legitimate tools as attack vectors and act accordingly.
Summary
The Crypto24 threat group represents a new level of cybersecurity sophistication by utilizing legitimate tools and advanced evasion techniques. They have successfully disrupted the security systems of dozens of vendors and removed defenses without deploying traditional malicious software. To counter this threat, organizations must harden their defense infrastructure, restrict permissions, and conduct continuous, intelligent monitoring of their systems.
For more information: New Crypto24 Ransomware Attacks Bypass EDR