Loading threat actor…
Crypt Ghouls is a cybercriminal ransomware actor identified in attacks against Russian businesses and government agencies. Victimology includes organizations in the public sector as well as mining, energy, finance, and retail. The group’s operations have been assessed as pursuing both operational disruption and financial gain. Observed intrusion chains show initial access through compromised contractor or subcontractor credentials used over VPN, indicating abuse of trusted third-party relationships. After access, the group has established persistence and remote administration with tools such as NSSM, Localtonet, AnyDesk, and resocks. Post-compromise activity includes credential theft using Mimikatz and XenAllPasswordPro, Kerberos ticket dumping, browser credential collection, and attempts to access Active Directory data including NTDS extraction. Reconnaissance and lateral movement have involved PingCastle, SoftPerfect Network Scanner, WMI, PsExec, and PAExec. Crypt Ghouls has also used a CobInt loader delivered via VBScript and obfuscated PowerShell, and has employed DLL sideloading for payload execution. For impact, Crypt Ghouls has deployed LockBit 3.0 on Windows systems and Babuk on Linux and ESXi environments. Reported ransomware behavior includes disabling security controls, deleting event logs, terminating selected processes and services, and encrypting virtual-machine-hosted data after SSH access to ESXi servers. The actor leaves ransom instructions and has been linked to extortion-oriented ransomware operations. Multiple investigations have identified substantial overlaps between Crypt Ghouls and other Russia-targeting clusters including MorLock, BlackJack, Twelve, and Shedding Zmiy (ExCobalt). Shared elements include tooling, naming conventions, infrastructure patterns, and tradecraft, suggesting collaboration, shared resources, or exchange of tooling and operational knowledge rather than a cleanly isolated cluster.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
31 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
11 malware families Mallory has associated with this actor across public reporting.
6 additional families tracked in Mallory.
21 indicators attributed to this actor. Values are masked here and available in full in Mallory.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.