CrazyHunter

CrazyHunter is an emerging ransomware group and ransomware family first observed in mid-2024. It is described as a Go-based fork of Prince ransomware that primarily targets organizations in Taiwan, with repeated attacks against the healthcare sector, including hospitals. Reporting cited six compromised or targeted organizations in Taiwan. The group commonly gains initial access by exploiting weaknesses in Active Directory environments, including weak domain passwords. It propagates laterally by abusing Group Policy Objects with SharpGPOAbuse, enabling rapid spread across enterprise networks. For privilege escalation and defense evasion, CrazyHunter uses a bring-your-own-vulnerable-driver technique with a modified Zemana anti-malware driver, zam64.sys, to terminate security products. Deployment has been reported to involve ru.bat, AV-killer components such as go.exe and go2.exe, the primary encryptor go3.exe, a Donut loader bb.exe with crazyhunter.sys shellcode, and a backup encryptor crazyhunter.exe. CrazyHunter encrypts Windows systems using ChaCha20 with partial encryption, typically encrypting one byte and skipping the next two, and protects per-file keys and nonces with ECIES. Encrypted files are typically renamed with a .hunter extension. The operators maintain a data leak site and conduct double extortion, threatening to publish stolen data if ransom demands are not paid. Their leak site reportedly includes a “Strategic Manifesto” and references “Premium Criminal Branding Services.” Victim communications have been reported via email, Telegram, and a Tor onion site, with ransom demanded in cryptocurrency. A dual-use tool, file.exe, has also been associated with operations and assessed as supporting extortion through file-server or monitoring/deletion functionality. Aliases directly mentioned in the content: crazyhunter.