Ransomware Group intelligence

Suncrypt

Inactive

Track Suncrypt with 32 published victims and 2 known leak locations in a single intelligence view.

BREACH HOUSE ALERTS

Want an alert every time a new ransomware post is published?

Choose the feeds and the countries you care about — we email you when they move.

Victims 32 Known published victims in this dataset

First discovered 2020-08-24 Earliest victim discovery date

Last discovered 2022-06-18 Latest victim discovery date

Inactive since 1536 days Days since the latest known victim

Top country United States 2 victims

Known locations 2 Leak or negotiation infrastructure tracked

Suncrypt is tracked by Breach House as a ransomware group with 32 published victims.

United States is currently the most targeted country in this dataset.

2 known leak locations are currently associated with this group.

Top Countries

Distribution

Label	Type	Availability	Links
Leak location 2	Onion service	Down checked 1h ago	`nbzzb6sa6xuura2z.onion`
Leak location 1	Onion service	Down checked 1h ago	`x2miyuiwpib2imjr5ykyjngdu7v6vprkkhjltrk4qafymtawey4qzwid.onion`

Typical Attacks (10)

▼

MITRE ATT&CK does not currently catalogue Suncrypt, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v19.2. Confidence: medium. Treat it as orientation, not attribution.

T1059.001 PowerShell Execution

What they do: suncrypt executes malicious payloads via PowerShell scripts to stage ransomware encryption routines.

What that means: Adversaries may abuse PowerShell commands and scripts for execution.
T1547.001 Registry Run Keys / Startup Folder PersistencePrivilege Escalation

What they do: suncrypt establishes persistence by injecting malicious entries into Windows Registry Run Keys.

What that means: Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key.
T1685 Disable or Modify Tools Defense Impairment

What they do: suncrypt disables antivirus tools and modifies security software configurations to evade detection.

What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
T1070.004 File Deletion Stealth

What they do: suncrypt deletes Volume Shadow Copies and backup directories via vssadmin to prevent recovery.

What that means: Adversaries may delete files left behind by the actions of their intrusion activity.
T1110 Brute Force Credential Access

What they do: suncrypt brute-forces local and domain account credentials using password-guessing tools for initial access.

What that means: Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained.
T1135 Network Share Discovery Discovery

What they do: suncrypt scans network shares using SMB tools to identify additional victims for lateral movement.

What that means: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.
T1021.002 SMB/Windows Admin Shares Lateral Movement

What they do: suncrypt moves laterally across networks by exploiting SMB/Windows Admin Shares to access additional systems.

What that means: Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).
T1567.002 Exfiltration to Cloud Storage Exfiltration

What they do: suncrypt exfiltrates victim data via encrypted C2 channels before deploying ransomware.

What that means: Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel.
T1486 Data Encrypted for Impact Impact

What they do: suncrypt encrypts victim files using custom ransomware binaries to maximize impact and extortion leverage.

What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
T1490 Inhibit System Recovery Impact

What they do: suncrypt halts system recovery processes by terminating critical services and processes post-encryption.

What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.

Crypto Wallets (1)

▼

$229,544 Received (USD)

1 Payments

1 Known wallets

$229,544 Largest single payment

2021-07-19 → 2021-07-19 Payment window

bitcoin · 1

Address	Chain	Received (USD)	Payments
`bc1qpmknwh4pgvkyqq840fhx7fw36nrzu8gskx369v`	bitcoin	$229,544	1

Crowdsourced payment data from Ransomwhere, licensed CC BY 4.0. Figures are what has been reported and attributed to this family, not a confirmed total. Cite as: Cable, Jack. (2024). Ransomwhere: A Crowdsourced Ransomware Payment Dataset (1.1.0) [Data set]. Zenodo. https://doi.org/10.5281/zenodo.6512122

Ransom Notes (1)

▼

The note this group leaves on a compromised machine. Click a filename to read it.

suncrypt.html html · 10232 chars

<!DOCTYPE html>
<html lang="en">
<head>
  <meta charset='utf-8'>
  <meta name='viewport' content='width=device-width,initial-scale=1'>
  <title></title>
  <style>
    html, body {
      background-color: #1a1a1a;
    }
    body {
      padding-top: 3rem !important;
    }
    #text h2 {
      color: white;
      font-size: 2rem;
      font-weight: 600;
      line-height: 1.125;
    }
    .tabs {
      -webkit-overflow-scrolling: touch;
      align-items: stretch;
      display: flex;
      font-size: 1rem;
      justify-content: space-between;
      overflow: hidden;
          overflow-x: hidden;
      overflow-x: auto;
      white-space: nowrap;
    }
    .tabs ul {
        align-items: center;
        border-bottom-color: #454545;
        border-bottom-style: solid;
        border-bottom-width: 1px;
        display: flex;
        flex-grow: 1;
        flex-shrink: 0;
        justify-content: flex-start;
    }  
      .tabs.is-toggle ul {
        border-bottom: none;
      }
      .tabs li {
          position: relative;
      }
      .tabs li {
          display: block;
      }      
      .tabs.is-toggle li.is-active a {
          background-color: white;
          border-color: white;
          color: rgba(0, 0, 0, 0.7);
          z-index: 1;
      }
      .tabs.is-toggle li:first-child a {
          border-top-left-radius: 3px;
          border-bottom-left-radius: 3px;
      }
      .tabs li.is-active a {
          border-bottom-color: white;
          color: white;
      }
      .tabs.is-toggle a {
          border-color: #454545;
          border-style: solid;
          border-width: 1px;
          margin-bottom: 0;
          position: relative;
      }
      .tabs a {
          align-items: center;
          border-bottom-color: #454545;
          border-bottom-style: solid;
          border-bottom-width: 1px;
          color: white;
          display: flex;
          justify-content: center;
          margin-bottom: -1px;
          padding: 0.5em 1em;
          vertical-align: top;
          cursor: pointer;
      }      
    .tabs.is-toggle li:last-child a {
        border-top-right-radius: 3px;
        border-bottom-right-radius: 3px;
    }      
    .container {
      max-width: 1152px;
      max-width: ;
      flex-grow: 1;
      margin: 0 auto;
      position: relative;
      width: auto;
    }
    .box {
      background-color: #242424;
      color: white;
      display: block;
      padding: 1.25rem;
      border: 1px solid #303030;
    }    
    blockquote {
      background: hsl(0, 0%, 20%);
      padding: 1rem;
      border-left: 3px solid #55a630;
    }
    a {
      color: #e55934;
    }
  </style>
  <script>
    let text = {
      en: `<h2> Whats Happen? </h2>
        We got your documents and files encrypted and you cannot access them. To make sure we�re not bluffing just check out your files. Want to recover them? Just do what we instruct you to. If you fail to follow our recommendations, you will never see your files again. During each attack, we copy valuable commercial data. If the user doesn’t pay to us, we will either send those data to rivals, or publish them. GDPR. Don’t want to pay to us, pay 10x more to the government. 

        <h2> What Guarantees? </h2>
        We’re doing our own business and never care about what you do. All we need is to earn. Should we be unfair guys, no one would work with us. So if you drop our offer we won’t take any offense but you’ll lose all of your data and files. How much time would it take to recover losses? You only may guess.

        <h2> How do I access the website? </h2>
        <ul>
          <li><a href="https://torproject.org" target="_blank">Get TOR browser here</a></li>
          <li><a href="http://ebwexiymbsib4rmw.onion/chat.html?[snap]">Go to our website</a></li>
        </ul>`,
      de: `<h2> Was ist gerade passiert? </h2>
        Wir haben Ihre Dokumente und Dateien verschlüsselt und Sie können nicht mehr darauf zugreifen. Jeder Angriff wird von einer Kopie der kommerziellen Informationen begleitet. Um sicherzustellen, dass wir es ernst meinen, prüfen Sie einfach Ihre Dateien und Sie werden sehen. Möchten Sie sie wiederherstellen? Halten Sie sich einfach an unsere Anweisungen, um uns zu bezahlen. Tuen Sie dies nicht, werden Sie Ihre Dateien niemals wiedersehen. Im Falle einer Zahlungsverweigerung werden die Daten entweder an Wettbewerber verkauft oder in offenen Quellen bereitgestellt. GDPR. Wenn Sie uns nicht bezahlen möchten, zahlen Sie das Zehnfache an der Regierung.

        <h2> Wie sollten Sie uns trauen ? </h2>
        Wir machen unsere eigenen Geschäfte und kümmern uns nicht darum was Sie tunen. Wir müssen nur verdienen. Sollten wir einfach nur bluffen, würde niemand an uns zahlen. Wenn Sie unser Angebot ablehnen, werden Sie alle Ihre Daten für immer verlieren. Wie viel Zeit werden Sie brauchen um ihre Daten selber zu ersetzen ? Sie können es sich schon denken.

        <h2> Unsere Forderungen </h2>
        <ul>
          <li><a href="https://torproject.org" target="_blank">Holen Sie sich den TOR-Browser hier</a></li>
          <li><a href="http://ebwexiymbsib4rmw.onion/chat.html?[snap]">Gehen Sie auf unsere Website</a></li>
        </ul>`,
      fr: `<h2> Qu'est-ce qui vient de se passer? </h2>
        Nous avons crypté vos documents et fichiers et vous ne pouvez pas y accéder. Chaque attaque est accompagnée d'une copie des informations commerciales. Pour vous assurer que nous ne bluffons pas. Voulez-vous les restaurer? Faites juste ce que nous vous demandons, pour nous payer. Si vous ne suivez pas nos recommandations, vous ne verrez plus jamais vos fichiers. En cas de refus de paiement - les données seront soit revendues à des concurrents, soit diffusées dans des sources ouvertes. GDPR. Si vous ne voulez pas nous payer, payez x10 fois le gouvernement.

        <h2> Qu'en est-il des garanties? </h2>
        Nous faisons nos propres affaires et ne nous soucions jamais de ce que vous faites. Tout ce dont nous avons besoin est de gagner de l'argent. Si nous devions être injustes, personne ne travaillerait avec nous. Donc, si vous abandonnez notre offre, nous ne prendrons aucune infraction, mais vous perdrez toutes vos données et vos fichiers. Combien de temps faudrait-il pour récupérer les pertes? Vous pouvez seulement deviner.

        <h2> Comment puis-je accéder au site web? </h2>
        <ul>
          <li><a href="https://torproject.org" target="_blank">Téléchargez le navigateur TOR ici</a></li>
          <li><a href="http://ebwexiymbsib4rmw.onion/chat.html?[snap]">Allez sur notre site web</a></li>
        </ul>`,
      es: `<h2> ¿Lo que de pasar? </h2>
        Ya tenemos sus documentos y archivos encriptados y usted no puede acceder a ellos. Para asegurarse de que no estamos faroleando. ¿Quiere recuperarlos? Sólo haga lo que le indicamos. Si usted no sigue nuestras recomendaciones, usted nunca verá sus archivos. Durante cada ataque, copiamos los datos comerciales valiosos. Si el usuario no nos paga, enviaremos estos datos a sus rivales o los publicaremos. GDPR. No quiere pagarnos, paga 10 veces más al gobierno.

        <h2> ¿Qué pasa con las garantías? </h2>
        Estamos haciendo nuestro propio negocio y nunca nos importa lo que hace usted. Todo lo que necesitamos es ganar. Hay que ser injustos chicos, nadie trabajaría con nosotros. Entonces, si deja caer nuestras propuestas, no nos ofenderemos pero usted perderá todos sus datos y archivos. ¿Cuánto tiempo se requiere para recuperar las pérdidas? Sólo usted puede adivinar.

        <h2> ¿Cómo acceder al sitio web? </h2>
        <ul>
          <li><a href="https://torproject.org" target="_blank">Obtenga el navegador TOR aquí</a></li>
          <li><a href="http://ebwexiymbsib4rmw.onion/chat.html?[snap]">Vaya a nuestro sitio web</a></li>
        </ul>`,
      jp: `<h2> 何があったのですか？ </h2>
        ドキュメントとファイルを暗号化しました。 それらにアクセスすることはできません。 ブラフしないようにするには、 ファイルをチェックアウトして、すべてが。 それらを回復したいですか？ ただや
        る
        指示すること。 指示に従わない場合、ファイルは二度と表示されません。 各攻撃中に、貴重な商用データをコピーします。 ユーザーが当社に支払わない場合は、それらのデータをライバルに送信するか、公開します。

        <h2> 何が保証されますか ? </h2>
        私たちは私たち自身のビジネスを行っており、あなたが何をするかを気にしません。 必要なのは稼ぐことだけです。 私たちが不公平な人である場合、誰も私たちと一緒に働くことはありません。 ですから、あなたが私たちの申し出をやめても、私たちは何の罪も犯しません
        すべてのデータとファイルが失われます。 損失を回復するのにどれくらい時間がかかりますか？ 推測するだけです。
        <h2> Webサイトにアクセスするにはどうすればよいですか？ </h2>
        <ul>
        <li><a href=" https://torproject.org " target="_blank">ここで TORブラウザを入手 </a></li>
        <li><a href="http://ebwexiymbsib4rmw.onion/chat.html?[snap]">当社のウェブサイトにアクセス </a></li>
        </ul>`
    };
    function sel_lang(event) {
      let active = document.getElementsByClassName('is-active')[0];
      active.classList.remove('is-active');
      event.target.parentElement.classList.add('is-active');
      let lang = event.target.getAttribute('data-lang');
      let el = document.getElementById('text');
      el.innerHTML = text[lang];
    }
    document.addEventListener("DOMContentLoaded", ()=>{
      let el = document.getElementById('text');
      el.innerHTML = text['en'];           
    });
  </script>
</head>
<body class='pt-6'>
<div class='container'>

<div class="tabs is-toggle">
  <ul>
    <li class="is-active"><a onclick='sel_lang(event);' data-lang='en'>EN</a></li>
    <li class=""><a onclick='sel_lang(event);' data-lang='de'>DE</a></li>
    <li class=""><a onclick='sel_lang(event);' data-lang='fr'>FR</a></li>
    <li class=""><a onclick='sel_lang(event);' data-lang='es'>ES</a></li>
    <li class=""><a onclick='sel_lang(event);' data-lang='jp'>JP</a></li>
  </ul>
</div>

<div class='box'>
<div id='text'></div>
  <div style='border: 1px solid red; padding: .5rem; font-size: 1.3rem; font-weight: 500; margin: 3rem 0;'>
    <div class='title is-4'>
    In case you decide not to cooperate, your private data will be published <a style='color: #46a049; text-decoration: underline;' target='_blank' href='http://nbzzb6sa6xuura2z.onion/'>here</a> or sold.
  </div>
</div>
<div style='margin-top: 2rem;'>
<h2>Offline how-to</h2>
<p>Copy & Paste this secret message to <a href="http://ebwexiymbsib4rmw.onion">this page</a> textarea field</p>
<p><blockquote>[snip]</blockquote></p>
</div>
</div>
</div>
</body>
</html>

View on RansomLook

Ransom-note text from RansomLook, licensed CC BY 4.0.

Type	Target	Discovered	Country	Business Category	Intel Link
Ransomware	SOCOTEC id3654 View details	2022-06-18		Other	—
No additional victim description available. ID 3654
Ransomware	Northeastern Technical College id3585 View details	2022-06-04		Education	—
No additional victim description available. ID 3585
Ransomware	Co-opbank Pertama id3262 View details	2022-04-24		Finance / Legal / Insurance	—
No additional victim description available. ID 3262
Ransomware	DJS associate id3187 View details	2022-04-16		Other	—
No additional victim description available. ID 3187
Ransomware	Gemeente Buren id3171 View details	2022-04-14		Other	—
No additional victim description available. ID 3171
Ransomware	Atlas Copco id3164 View details	2022-04-14		Other	—
No additional victim description available. ID 3164
Ransomware	Oklahoma City Indian Clinic id2983 View details	2022-03-28		Healthcare / Pharma	—
No additional victim description available. ID 2983
Ransomware	FitFlop Ltd. id2864 View details	2022-03-17		Services	—
No additional victim description available. ID 2864
Ransomware	Migros id2839 View details	2022-03-16		Other	—
No additional victim description available. ID 2839
Ransomware	Royal Smilde id2677 View details	2022-02-21		Other	—
No additional victim description available. ID 2677
Ransomware	CENTRAL BAPTIST COLLEGE id2676 View details	2022-02-21		Education	—
No additional victim description available. ID 2676
Ransomware	KVK Tech \| Specialty Brands and Generics id2643 View details	2022-02-15		IT	—
No additional victim description available. ID 2643
Ransomware	Heartland Alliance id2590 View details	2022-02-08		Other	—
No additional victim description available. ID 2590
Ransomware	Community Health Center \| Valle del Sol id2589 View details	2022-02-08		Healthcare / Pharma	—
No additional victim description available. ID 2589
Ransomware	Consumers Supply Distributing LLC id2575 View details	2022-02-05		Services	—
No additional victim description available. ID 2575
Ransomware	Bohlin Cywinski Jackson id2060 View details	2021-12-03		Other	—
No additional victim description available. ID 2060
Ransomware	Read more id2047 View details	2021-11-30		Other	—
No additional victim description available. ID 2047
Ransomware	Hospitality Furnishings & Design Inc. id1946 View details	2021-11-19		Healthcare / Pharma	—
No additional victim description available. ID 1946
Ransomware	Herman & Kittle Properties Inc. id1945 View details	2021-11-19		Communication / Marketing	—
No additional victim description available. ID 1945
Ransomware	Outdoor Venture Corporation (OVC) id1782 View details	2021-11-05		Services	—
No additional victim description available. ID 1782
Ransomware	Tri-signal Intergration id707 View details	2021-09-09		Other	—
No additional victim description available. ID 707
Ransomware	Glen Dimplex Home Appliances id706 View details	2021-09-09		Other	—
No additional victim description available. ID 706
Ransomware	Grushwitz id705 View details	2021-09-09		Other	—
No additional victim description available. ID 705
Ransomware	Mark A. O'neal and Associates id704 View details	2021-09-09		Other	—
No additional victim description available. ID 704
Ransomware	AGSO id703 View details	2021-09-09		Other	—
No additional victim description available. ID 703
Ransomware	Dean and Fulkerson id702 View details	2021-09-09		Other	—
No additional victim description available. ID 702
Ransomware	SB Zantal Markt id701 View details	2021-09-09		Other	—
No additional victim description available. ID 701
Ransomware	JSW Steel USA id700 View details	2021-09-09		Manufacturing / Engineering	—
No additional victim description available. ID 700
Ransomware	PRP diagnostic imaging id699 View details	2021-09-09		Communication / Marketing	—
No additional victim description available. ID 699
Ransomware	Cornerstone Automation Systems, LLC id689 View details	2021-09-09		Services	—
No additional victim description available. ID 689
Ransomware	University Hospital New Jersey id473 View details	2020-09-01	United States	Healthcare / Pharma	—
No additional victim description available. ID 473
Ransomware	Haywood County School District id463 View details	2020-08-24	United States	Education	—
No additional victim description available. ID 463

Suncrypt

Overview

Top Countries

Known Leak Locations (2)

Top Activity Sectors (8)

Typical Attacks (10)

Crypto Wallets (1)

Ransom Notes (1)

Victims (32)

Restricted Access

Now you can see the leak, not just the listing