Ransomware Group intelligence
CRPxO
ActiveTrack CRPxO with 62 published victims and 5 known leak locations in a single intelligence view.
BREACH HOUSE ALERTS
Want an alert every time a new ransomware post is published?
Choose the feeds and the countries you care about — we email you when they move.
Overview
CRPxO is tracked by Breach House as a ransomware group with 62 published victims.
United States is currently the most targeted country in this dataset.
5 known leak locations are currently associated with this group.
Top Countries
Interactive distribution based on the currently visible victims list.
Known Leak Locations (5)
| Label | Type | Availability | Links |
|---|---|---|---|
| Leak location 3 | Web location | Up checked 50m ago | crpx0.su |
| Leak location 4 | Web location | Up checked 50m ago | crpx0.su/affiliate |
| Leak location 5 | Onion service | Down checked 50m ago | kqi5yty6ipuhwz4anutty6hob6et7dvnnxg6kcnulwedjaz5oton2zyd.onion |
| Leak location 2 | Onion service | Down checked 50m ago | xburs4nr6cbuktokhqwefeh5hsjakz6usll5o7z5uhrfcnolakj4ptad.onion |
| Leak location 1 | Onion service | Down checked 50m ago | tlxoddx4odmc2qvsmtsbgwwsv5j45osb5sox7mz6izxliuju5mkulzad.onion |
Top Activity Sectors (8)
Typical Attacks (10)
▼MITRE ATT&CK does not currently catalogue CRPxO, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v19.2. Confidence: medium. Treat it as orientation, not attribution.
-
T1059.001 PowerShell Execution
What they do: CRPxO executes malicious payloads via PowerShell scripts to perform discovery, privilege escalation, and lateral movement.
What that means: Adversaries may abuse PowerShell commands and scripts for execution.
-
What they do: CRPxO persists via Registry Run Keys and startup folders to ensure ransomware execution after system reboots.
What that means: Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key.
-
T1685 Disable or Modify Tools Defense Impairment
What they do: CRPxO disables antivirus and monitoring tools by terminating security processes and modifying system configurations to evade detection.
What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
-
T1070.004 File Deletion Stealth
What they do: CRPxO deletes Volume Shadow Copies and backup directories using file deletion commands to prevent recovery.
What that means: Adversaries may delete files left behind by the actions of their intrusion activity.
-
T1003.001 LSASS Memory Credential Access
What they do: CRPxO accesses LSASS memory using credential-stealing tools to harvest user credentials for lateral access.
What that means: Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS).
-
T1135 Network Share Discovery Discovery
What they do: CRPxO uses network share discovery to locate victim file shares and identify high-value data for exfiltration or encryption.
What that means: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.
-
T1021.002 SMB/Windows Admin Shares Lateral Movement
What they do: CRPxO leverages SMB/Windows Admin Shares for lateral movement across networked hospital, financial, and manufacturing systems.
What that means: Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).
-
T1486 Data Encrypted for Impact Impact
What they do: CRPxO encrypts victim files with custom ransomware payloads targeting critical healthcare, finance, and engineering data.
What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
-
T1489 Service Stop Impact
What they do: CRPxO stops critical healthcare, database, and financial services via net stop commands to disrupt victim operations.
What that means: Adversaries may stop or disable services on a system to render those services unavailable to legitimate users.
-
T1490 Inhibit System Recovery Impact
What they do: CRPxO inhibits system recovery by corrupting restore points and disabling backup services to maximize operational disruption.
What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.
Victims (62)
Search, filter and paginate the victim timeline for CRPxO. Showing 1–62 of 62.
| Type | Target | Discovered | Country | Business Category | Intel Link |
|---|---|---|---|---|---|
| Ransomware | Encore Enterprises, Inc. id31152 View details | United States | Real Estate | ||
|
Encore Enterprises, Inc. is a real estate company based in the United States. The company operates in the real estate sector, providing various services. Encore Enterprises, Inc. was listed as a ransomware victim associated with CRPxO |
|||||
| Ransomware | Encore Enterprises, Inc. id31152 View details | United States | Real Estate | ||
|
Sector: Commercial Real Estate | Data leaked: 700.0 GB |
|||||
| Ransomware | KUVEYT TURK id31119 View details | Türkiye | Finance / Legal / Insurance | — | |
|
KUVEYT TURK is a Turkish financial institution operating in the finance, legal, and insurance sector. The company provides various financial services to its customers in Turkey. KUVEYT TURK was listed as a ransomware victim associated with CRPxO |
|||||
| Ransomware | KUVEYT TURK id31119 View details | Türkiye | Finance / Legal / Insurance | — | |
|
Sector: Banking | Data leaked: 0.8 GB |
|||||
| Ransomware | FINANSBANK id31120 View details | Türkiye | Finance / Legal / Insurance | — | |
|
FINANSBANK is a financial services company based in Turkey, operating in the finance, legal, and insurance sectors. The company provides a range of financial products and services to its customers. FINANSBANK was listed as a ransomware victim associated with CRPxO |
|||||
| Ransomware | FINANSBANK id31120 View details | Türkiye | Finance / Legal / Insurance | — | |
|
Sector: Banking | Data leaked: 2.3 GB |
|||||
| Ransomware | ANADOLUBANK id31121 View details | Türkiye | Finance / Legal / Insurance | — | |
|
Anadolu Bank is a financial institution based in Turkey, operating in the finance, legal, and insurance sector, providing various financial services to its customers. As a major bank in Turkey, it offers a range of products and services, including personal and corporate banking, investment, and insurance. Anadolu Bank was listed as a ransomware victim associated with CRPxO |
|||||
| Ransomware | ANADOLUBANK id31121 View details | Türkiye | Finance / Legal / Insurance | — | |
|
Sector: Banking | Data leaked: 0.4 GB |
|||||
| Ransomware | THY id31122 View details | Türkiye | Transportation / Travel / Logistics | — | |
|
THY is a major transportation company based in Turkey, operating in the transportation, travel, and logistics sector. The company provides various services, including passenger and cargo transportation. THY was listed as a ransomware victim associated with CRPxO |
|||||
| Ransomware | THY id31122 View details | Türkiye | Transportation / Travel / Logistics | — | |
|
Sector: Aviation | Data leaked: 4.2 GB |
|||||
| Ransomware | JOHNSON & JOHNSON id31123 View details | United States | Healthcare / Pharma | — | |
|
Johnson & Johnson is a multinational healthcare company based in the United States, primarily operating in the pharmaceutical and medical devices sector. The company develops and manufactures a wide range of products, including prescription medications, vaccines, and consumer healthcare products. Johnson & Johnson was listed as a ransomware victim associated with CRPxO. |
|||||
| Ransomware | JOHNSON & JOHNSON id31123 View details | United States | Healthcare / Pharma | — | |
|
Sector: Healthcare / Pharmaceutical | Data leaked: 1.9 GB |
|||||
| Ransomware | DOĞAN HOLDİNG id31124 View details | Türkiye | Finance / Legal / Insurance | — | |
|
DOĞAN HOLDİNG is a Turkish conglomerate operating in various sectors including finance, legal, and insurance. The company provides a range of services to its clients in Turkey. DOĞAN HOLDİNG was listed as a ransomware victim associated with CRPxO |
|||||
| Ransomware | DOĞAN HOLDİNG id31124 View details | Türkiye | Finance / Legal / Insurance | — | |
|
Sector: Media / Energy Conglomerate | Data leaked: 3.1 GB |
|||||
| Ransomware | ANADOLU SİGORTA id31125 View details | Türkiye | Finance / Legal / Insurance | — | |
|
ANADOLU SİGORTA is a Turkish insurance company operating in the finance and legal sectors, providing various insurance services to its customers in Turkey. As a key player in the Turkish insurance market, the company offers a range of insurance products. ANADOLU SİGORTA was listed as a ransomware victim associated with CRPxO |
|||||
| Ransomware | ANADOLU SİGORTA id31125 View details | Türkiye | Finance / Legal / Insurance | — | |
|
Sector: Insurance | Data leaked: 1.2 GB |
|||||
| Ransomware | HYUNDAI id31126 View details | Korea, Republic of | Manufacturing / Engineering | — | |
|
HYUNDAI is a prominent South Korean multinational conglomerate headquartered in Seoul, South Korea, primarily engaged in the manufacturing and engineering sector, offering a wide range of products including automobiles, construction equipment, and industrial machinery. As a leading player in the global automotive industry, HYUNDAI operates a vast network of subsidiaries and affiliates worldwide. HYUNDAI was listed as a ransomware victim associated with CRPxO |
|||||
| Ransomware | HYUNDAI id31126 View details | Korea, Republic of | Manufacturing / Engineering | — | |
|
Sector: Automotive | Data leaked: 1.5 GB |
|||||
| Ransomware | ASELSAN id31127 View details | Türkiye | Manufacturing / Engineering | — | |
|
ASELSAN is a leading Turkish company operating in the manufacturing and engineering sector, offering various products and solutions. The company is based in Turkey and provides a range of services to its clients. ASELSAN was listed as a ransomware victim associated with CRPxO |
|||||
| Ransomware | ASELSAN id31127 View details | Türkiye | Manufacturing / Engineering | — | |
|
Sector: Defense / Electronics | Data leaked: 4.5 GB |
|||||
| Ransomware | A101 id31128 View details | Türkiye | — | — | |
|
A101 is a Turkish retail company operating in the retail sector, offering a range of products to customers in Turkey. The company is part of the retail industry, providing various services and products to its customers. A101 was listed as a ransomware victim associated with CRPxO |
|||||
| Ransomware | A101 id31128 View details | Türkiye | — | — | |
|
Sector: Grocery / Retail | Data leaked: 0.2 GB |
|||||
| Ransomware | IPTV Platform id30957 View details | United States | Telecommunications | ||
|
IPTV Platform is a telecommunications company based in the US, offering internet protocol television services to its customers. The company operates in the telecommunications sector, providing various services including television programming and streaming. IPTV Platform was listed as a ransomware victim associated with CRPxO. |
|||||
| Ransomware | IPTV Platform id30957 View details | United States | Telecommunications | ||
|
Sector: Technology / Video Streaming | Data leaked: 3.2 GB |
|||||
| Ransomware | Marketech id30958 View details | United States | Communication / Marketing | ||
|
Marketech is a company operating in the communication and marketing sector, based in the United States. The company likely provides services such as marketing solutions and communication strategies to its clients. Marketech was listed as a ransomware victim associated with CRPxO |
|||||
| Ransomware | Marketech id30958 View details | United States | Communication / Marketing | ||
|
Sector: Marketing / SEO | Data leaked: 6.7 GB |
|||||
| Ransomware | American Hospice & Home Health Services (Ahhh Care) id30959 View details | United States | Healthcare / Pharma | ||
|
American Hospice & Home Health Services, or Ahhh Care, is a healthcare provider based in the United States, offering home health and hospice services to patients in need. The company operates within the healthcare and medicine sector, providing essential care to individuals in the US. It was listed as a ransomware victim associated with CRPxO. |
|||||
| Ransomware | American Hospice & Home Health Services (Ahhh Care) id30959 View details | United States | Healthcare / Pharma | ||
|
Sector: Healthcare / Hospice | Data leaked: 11.3 GB |
|||||
| Ransomware | Bright Star Partners Insurance id30960 View details | United States | Finance / Legal / Insurance | ||
|
Bright Star Partners Insurance is a financial and insurance services provider based in the United States, operating within the finance and legal sectors. The company offers various insurance products and services to its clients. It was listed as a ransomware victim associated with CRPxO. |
|||||
| Ransomware | Bright Star Partners Insurance id30960 View details | United States | Finance / Legal / Insurance | ||
|
Sector: Insurance / Financial Services | Data leaked: 41.8 GB |
|||||
| Ransomware | eCare Platform id30961 View details | United States | Healthcare / Pharma | ||
|
eCare Platform is a healthcare company based in the US, providing medical services and support. The company operates in the healthcare sector, offering various medical solutions. eCare Platform was listed as a ransomware victim associated with CRPxO |
|||||
| Ransomware | eCare Platform id30961 View details | United States | Healthcare / Pharma | ||
|
Sector: Healthcare / Technology | Data leaked: 14.2 GB |
|||||
| Ransomware | Dignity Phoenix id30962 View details | United States | — | ||
|
Sector: Non-Profit / Social Services | Data leaked: 5.4 GB |
|||||
| Ransomware | Schorr Law id30963 View details | United States | — | ||
|
Sector: Legal / Real Estate | Data leaked: 27.6 GB |
|||||
| Ransomware | Simpkins Law Firm id30964 View details | United States | — | ||
|
Sector: Legal / Family Law | Data leaked: 31.2 GB |
|||||
| Ransomware | Leah Walker Orthodontics id30965 View details | United States | — | ||
|
Sector: Healthcare / Orthodontics | Data leaked: 8.3 GB |
|||||
| Ransomware | Elko Dental Specialists id30966 View details | United States | — | ||
|
Sector: Healthcare / Dental | Data leaked: 7.8 GB |
|||||
| Ransomware | ProSmile Family Dental Care id30946 View details | United States | Healthcare / Pharma | ||
|
ProSmile Family Dental Care is a healthcare service provider in the US, offering dental care services to families. As a part of the healthcare sector, it provides various medical services. ProSmile Family Dental Care was listed as a ransomware victim associated with CRPxO. |
|||||
| Ransomware | ProSmile Family Dental Care id30946 View details | United States | Healthcare / Pharma | ||
|
Sector: Healthcare / Dental | Data leaked: 9.6 GB |
|||||
| Ransomware | Qube Aviation Catering id30947 View details | United States | Hospitality / Food & Beverage / Tourism | ||
|
Qube Aviation Catering is a US-based company operating in the hospitality sector, specifically catering to the aviation industry. The company provides food and beverage services to airlines and airports across the United States. As a key player in the tourism and hospitality sector, Qube Aviation Catering offers a range of services to enhance the travel experience. Qube Aviation Catering was listed as a ransomware victim associated with CRPxO |
|||||
| Ransomware | Qube Aviation Catering id30947 View details | United States | Hospitality / Food & Beverage / Tourism | ||
|
Sector: Aviation / Catering | Data leaked: 22.5 GB |
|||||
| Ransomware | Performance Data Solutions id30948 View details | United States | — | ||
|
Sector: Motorsport / Data Acquisition | Data leaked: 12.8 GB |
|||||
| Ransomware | Host & Protect (RedBlink) id30949 View details | United States | — | ||
|
Sector: Web Hosting / Security | Data leaked: 156.2 GB |
|||||
| Ransomware | Host & Protect (RedBlink) id30949 View details | Ireland | — | ||
|
Sector: Web Hosting / Security | Data leaked: 156.2 GB |
|||||
| Ransomware | RnnR Cloud id30950 View details | United States | — | ||
|
Sector: Technology / Cloud Services | Data leaked: 68.9 GB |
|||||
| Ransomware | CodeConductor.ai id30951 View details | United States | — | ||
|
Sector: Technology / AI / SaaS | Data leaked: 52.4 GB |
|||||
| Ransomware | Prei Capital id30952 View details | United States | — | ||
|
Sector: Financial / Capital | Data leaked: 18.7 GB |
|||||
| Ransomware | FLP Law Group LLP id30953 View details | United States | — | ||
|
Sector: Legal / Bankruptcy | Data leaked: 42.1 GB |
|||||
| Ransomware | Summit Hill Insurance id30954 View details | United States | — | ||
|
Sector: Insurance | Data leaked: 34.5 GB |
|||||
| Ransomware | MRO Aerospace id30955 View details | United States | — | ||
|
Sector: Aerospace / Defense | Data leaked: 87.3 GB |
|||||
| Ransomware | Creative Smiles Pediatric Dentistry id30363 View details | United States | Healthcare / Pharma | ||
|
Creative Smiles Pediatric Dentistry is a pediatric dentistry practice in the US, offering various dental services to children. As a healthcare provider, it plays a crucial role in the medical sector. Creative Smiles Pediatric Dentistry was listed as a ransomware victim associated with CRPxO |
|||||
| Ransomware | Creative Smiles Pediatric Dentistry id30363 View details | United States | Healthcare / Pharma | ||
|
Sector: Pediatric Dentistry | Data leaked: 2.5 GB |
|||||
| Ransomware | AMHWA Biopharm Co., Ltd. id30364 View details | China | Healthcare / Pharma | ||
|
AMHWA Biopharm Co., Ltd. is a Chinese company operating in the healthcare and pharmaceutical sector. The company is involved in the development and manufacturing of pharmaceutical products. AMHWA Biopharm Co., Ltd. was listed as a ransomware victim associated with CRPxO |
|||||
| Ransomware | AMHWA Biopharm Co., Ltd. id30364 View details | China | Healthcare / Pharma | ||
|
Sector: Biopharmaceutical | Data leaked: 37.0 GB |
|||||
| Ransomware | SF Smile Doctor id30365 View details | United States | Healthcare / Pharma | ||
|
SF Smile Doctor is a healthcare service provider based in the US, offering medical services in the field of medicine. As a healthcare provider, SF Smile Doctor is likely involved in various medical specialties. SF Smile Doctor was listed as a ransomware victim associated with CRPxO |
|||||
| Ransomware | SF Smile Doctor id30365 View details | United States | Healthcare / Pharma | ||
|
Sector: Medical | Data leaked: 100.0 GB |
|||||
| Ransomware | Bishop Arts Dental PLLC id30366 View details | United States | Healthcare / Pharma | ||
|
Bishop Arts Dental PLLC is a healthcare service provider located in the US, offering dental care services to its patients. As a part of the healthcare sector, the company is committed to providing quality medical services. Bishop Arts Dental PLLC was listed as a ransomware victim associated with CRPxO. |
|||||
| Ransomware | Bishop Arts Dental PLLC id30366 View details | United States | Healthcare / Pharma | ||
|
Sector: Medical | Data leaked: 24.6 GB |
|||||
| Ransomware | Top Notch Dentistry of Dallas id30367 View details | United States | Healthcare / Pharma | ||
|
Top Notch Dentistry of Dallas is a dental care provider based in Dallas, US, offering various healthcare services. As a part of the healthcare sector, the entity provides medical services to its patients. Top Notch Dentistry of Dallas was listed as a ransomware victim associated with CRPxO |
|||||
| Ransomware | Top Notch Dentistry of Dallas id30367 View details | United States | Healthcare / Pharma | ||
|
Sector: Medical | Data leaked: 2.0 GB |
|||||
| Ransomware | Benjamin H. Wang DDS Inc. id30368 View details | United States | Healthcare / Pharma | ||
|
Benjamin H. Wang DDS Inc. is a dental healthcare service provider based in the United States, offering various medical services to patients. As a part of the healthcare sector, the company is dedicated to providing quality care. Benjamin H. Wang DDS Inc. was listed as a ransomware victim associated with CRPxO. |
|||||
| Ransomware | Benjamin H. Wang DDS Inc. id30368 View details | United States | Healthcare / Pharma | ||
|
Sector: Medical | Data leaked: 1.2 GB |
|||||