Loading threat actor…
CRYSTALRAY is a cybercrime threat actor associated with large-scale opportunistic exploitation of internet-facing services. The actor emerged from activity previously tracked around the SSH-Snake worm and expanded into a broader campaign cluster focused on mass scanning, vulnerability exploitation, credential theft, persistence, lateral movement, and cryptomining. Reported operations have affected more than 1,500 victims and show a strong emphasis on automation and reuse of open-source offensive tooling. CRYSTALRAY conducts reconnaissance and scanning at scale, including country-targeted enumeration of exposed services and validation of discovered hosts before exploitation. Observed targeting has included enterprise applications and middleware such as Confluence, ActiveMQ, Metabase, WebLogic, Solr, Openfire, RocketMQ, and Laravel deployments, with exploitation of known vulnerabilities including CVE-2022-44877, CVE-2021-3129, and CVE-2019-18394. The actor has been observed modifying public proof-of-concept exploits to add malicious payload delivery rather than developing bespoke exploit chains. Following initial access, CRYSTALRAY establishes persistence through backdoors and reverse-shell infrastructure, including use of Sliver-generated implants and Platypus-managed access. The actor has also used SSH-Snake for lateral movement and propagation through compromised environments by harvesting SSH credentials and related artifacts. Credential theft is a central feature of the operation: CRYSTALRAY has been observed collecting secrets from environment files and shell histories, including cloud and SaaS credentials, and is assessed to monetize stolen access through criminal marketplaces and Telegram channels. Additional post-compromise behavior includes exfiltration of collected credential material, deployment of cryptominers, persistence via scheduled tasks and service mechanisms, and termination of competing miner processes to retain exclusive use of victim resources. Known aliases and related tracking include SSH-Snake activity associated with the same campaign cluster. CRYSTALRAY is best characterized as a financially motivated cybercrime actor that combines commodity tooling, scalable internet-wide targeting, credential theft, and resource hijacking.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
5 malware families Mallory has associated with this actor across public reporting.
1 indicator attributed to this actor. Values are masked here and available in full in Mallory.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.