Loading threat actor…
CrazyHunter, also known as Crazy Hunter, crazy_hunter, and crazyhunters, is a financially motivated ransomware and extortion operation active in early 2025. Its attacks primarily target Taiwan, particularly hospitals and healthcare organizations, alongside industrial and technology companies. Known healthcare victims include Mackay Memorial Hospital. The operators maintain a data leak site and threaten to publish stolen victim data unless cryptocurrency ransom demands are met. CrazyHunter exploits weaknesses in Active Directory environments, including weak domain-account passwords, to gain access. It uses compromised accounts and SharpGPOAbuse to modify Group Policy Objects for lateral propagation and persistence. Its bring-your-own-vulnerable-driver technique abuses a vulnerable, signed Zemana anti-malware driver for privilege escalation and termination of security processes, including Windows Defender and Trend Micro products. The operation also employs Donut-generated shellcode and in-memory payload execution to evade detection. The Windows ransomware is written in Go and derived from the publicly available Prince ransomware builder. It uses partial ChaCha20 encryption with per-file keys and nonces protected by ECIES, accelerating encryption while disrupting access to victim data. Supporting tooling provides file-serving and directory-monitoring functionality, including file deletion. Its reliance on publicly available offensive tools and ransomware-building code is a defining characteristic of the operation.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
19 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
2 malware families attributed to this actor across reporting.
10 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
The article associates CrazyHunter with an attack against a healthcare institution in Taiwan, allegedly using GPO to distribute ransomware that encrypted files and disabled numerous computers. It explicitly states that the victim identity, attribution, and technical details require verification.
Ransomware activity cluster conducting attacks in Taiwan, especially against hospitals and some industrial organizations, using publicly available tooling including a Prince Ransomware-based encrypter, BYOVD to disable security tools, SharpGPOAbuse for lateral movement, and a custom file server/monitoring tool likely for exfiltration and recovery prevention.
Criminal actor described as using stealth tactics with initial access commonly via weak Active Directory credentials/passwords, enabling further compromise of enterprise environments.
Ransomware operation targeting healthcare organizations (notably hospitals) in Taiwan, using weak Active Directory passwords for initial access, SharpGPOAbuse to weaponize GPOs for rapid domain-wide spread, and BYOVD with a modified Zemana driver (zam64.sys) to terminate security tools; conducts double-extortion via a leak site and demands crypto ransoms.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.