CRPx0 Cybercrime Group Claims 5-Fold Increase in Victims
The ransomware and data theft service expanded operations during summer 2023.
1CRPx0's Rapid Ascent
CRPx0, which had fewer than 10 victims in June, now claims 48 victims after expanding operations over the summer. The group evolved from a scam service to ransomware and crypto theft operations. Researcher Rakesh Krishnan was among the first to expose CRPx0's activities and malware samples.
2White-Label Hacking Service
CRPx0 operates a hacking service offering 'complete database extraction' and 'optional leak coordination.' They also provide end-to-end network compromise services. Their ransomware-as-a-service platform enables criminals to operate under their own brand. Initially, these services required a one-time $10,000 fee.
3Profit-Sharing Model
CRPx0 initially promised affiliates 100% of profits—unprecedented in ransomware-as-a-service. This changed to a 70-30 split, with affiliates keeping 70% of ransom payments after a $333 enrollment fee. The group prohibits attacks on Commonwealth of Independent States members, following Russian cybercrime norms.
4ClickFix Delivery Methods
CRPx0 uses social engineering lures like fake Windows Updates and Google reCAPTCHA. Windows users are tricked into executing PowerShell commands, while macOS users are targeted via curl|bash. Researchers identified four payload formats, all delivering the same Python-based ransomware that steals files before encryption.
5Advanced Control Center
On August 23, CRPx0 announced v3.0 with a 'complete, professional offensive control center.' This web dashboard lets criminals manage compromised machines, steal valuable data, and set up automated attack reactions. The interface is designed for non-technical users, hiding complex attack engines behind simple controls.
6Threat Implications
Bitdefender's Jade Brown suggests CRPx0's services could be either a recruitment strategy or a scam targeting aspiring cybercriminals. She warns other threat actors may adopt similar techniques, urging organizations to balance detection capabilities against various compromise types, including both crypto theft and encryption processes.
7Defensive Measures
Ransomware-ISAC recommends five prioritized actions. The first three are free and block all ClickFix attacks: Remove the Run dialog for standard users, restrict Terminal via MDM on macOS, and monitor RunMRU writes containing PowerShell, curl, or long base64 strings. These measures detect CRPx0 and similar threats with high accuracy.
8Industry Takeaways
CRPx0's growth demonstrates ransomware-as-a-service becoming more accessible and sophisticated. Organizations remain vulnerable to social engineering targeting non-technical staff. Experts emphasize basic defenses can thwart many attacks, highlighting the critical need for cybersecurity training and fundamental protection measures across industries.