Crypto24
A ransomware group reported by Trend Micro in August 2025 for stealthy attacks on large organisations. It disables security tools using a custom driver-abuse tool and works during off-peak hours.
Threat actor profile. Last reviewed 3 November 2026.
Why It Matters
Crypto24 shows why having EDR is not the same as having EDR that survives an attack. Trend Micro describes a custom variant of RealBlindingEDR that uses drivers to remove security callbacks, and the abuse of a legitimate uninstaller through Group Policy to remove endpoint protection.1 Trend Micro says this is not a vulnerability and needs prior administrator access.1
Trend Micro says victims are large organisations in finance, manufacturing, entertainment and technology across Asia, Europe and the USA, with attacks launched during off-peak hours.1 The sources do not establish a specific UK link.
BleepingComputer reports Trend Micro's view that the group's skill suggests it may have been formed by former core members of defunct ransomware operations.2 That is an inference, not an established fact.
We would alert on any security agent going silent, especially outside business hours, and treat it as an incident until explained.
How It Attacks
Based on Trend Micro's analysis.1 It covers activity after the attacker already has access.
- 1
Prepare Accounts
Reactivates default admin accounts and creates generically named accounts with admin and remote desktop rights.
- 2
Discover the Network
Uses scripts and built-in commands to gather system and user data, and installs an IP scanner.
- 3
Persist
Creates scheduled tasks and services disguised as Windows components.
- 4
Disable Security
Uses a custom tool to remove security callbacks, and an uninstaller to remove endpoint protection.
- 5
Move Across
Uses PsExec, RDP, WMI and TightVNC.
- 6
Capture and Steal
Runs a keylogger and uploads data to Google Drive.
- 7
Encrypt and Clean Up
Deletes shadow copies, encrypts files and removes traces.
Key Techniques
Our mapping of the behaviour Trend Micro describes.1 ATT&CK v20 has no entry for this group.
| ID | Technique | Tactic | What It Looks Like |
|---|---|---|---|
| T1078.003 | Local Accounts | Persistence | Reactivates default admin accounts. |
| T1136.001 | Local Account | Persistence | Creates generically named admin accounts. |
| T1053.005 | Scheduled Task | Persistence | Runs scripts through scheduled tasks. |
| T1548.002 | Bypass User Account Control | Privilege Escalation | Uses a COM interface for UAC bypass. |
| T1685 | Disable or Modify Tools | Defense Impairment | Removes security callbacks and uninstalls agents. |
| T1021.001 | Remote Desktop Protocol | Lateral Movement | Enables RDP through registry and firewall changes. |
| T1056.001 | Keylogging | Collection | Captures keystrokes and window titles. |
| T1567.002 | Exfiltration to Cloud Storage | Exfiltration | Uploads to Google Drive. |
| T1490 | Inhibit System Recovery | Impact | Deletes shadow copies. |
| T1486 | Data Encrypted for Impact | Impact | Encrypts files. |
Tools Observed
Remote Access
Security Evasion
Other
From Trend Micro.1 Several are legitimate tools, so finding one does not prove compromise.
Vulnerabilities
The sources we reviewed name no CVE. Trend Micro says the uninstaller abuse is not a vulnerability.1
Warning Signs
Drawn from Trend Micro's advice.1
- Default admin accounts reactivated, or new generic admin accounts
- New scheduled tasks or services posing as Windows components
- Security agents uninstalled or going silent
- RDP enabled through registry or firewall changes
- Unusual outbound uploads to cloud storage
Defences That Matter
Limit Privilege
- Audit privileged accounts and disable unused default administrators.1
- Restrict RDP and remote tools to authorised systems and enforce MFA.1
Protect the Protection
- Keep EDR current, monitor for uninstall or bypass attempts and enable agent self-protection.1
- Ensure agent coverage on all systems.1
Watch Off-Peak Hours
- Inspect scheduled tasks and new services regularly.1
- Monitor unusual outbound traffic, including to cloud storage.1
Be Ready to Recover
Incident responseWould You Notice if Your EDR Went Quiet?
We can help you test your detection and response against these techniques.
Sources
- Trend Micro: Crypto24 Ransomware Group Blends Legitimate Tools with Custom Malware for Stealth Attacks, 14 August 2025
- BleepingComputer: Crypto24 ransomware hits large orgs with custom EDR evasion tool, 14 August 2025
MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. ATT&CK terms of use.