Loading story…
The Cryakl ransomware family, also known as Fantomas, Crykal, and later CryLock, developed from early spam-driven attacks into a broader ransomware operation that encrypted files without needing live command-and-control communication and increasingly relied on affiliate-style distribution. Early campaigns targeted victims primarily in Russia, with additional activity in Germany, Kazakhstan, Ukraine, Belarus, Japan, and Italy, using phishing emails and malicious archives to deliver Delphi-based malware that encrypted portions of files, stored metadata locally, persisted through Windows registry keys, and in some cases installed the password-stealing trojan Trojan-PSW.Win32.Ruftar alongside the ransomware. Researchers also documented versions that used layered encryption with locally generated keys and hardcoded remote RSA public keys, allowing attackers to extort victims without any online key exchange.
The operation later adopted tactics associated with modern double extortion. Deutsche Telekom linked at least one intrusion to a CryLock affiliate that encrypted a victim environment, displayed a pre-login legal warning, and threatened to publish stolen data through the LOCKDATA Auction leak marketplace, underscoring the shift from pure encryption to data-theft coercion. Separately, Belgian police seized Cryakl command-and-control servers and obtained private keys that enabled Kaspersky to expand decryption support in RakhniDecryptor, helping victims recover files from several Cryakl variants and disrupting one of the more prominent ransomware families active in Russia.
TTPs, infrastructure, and targeting history in one profile.
13 events from the most recent confirmed update back to the earliest known activity.
Deutsche Telekom Security said LOCKDATA Auction had been known to it since May 2021. The portal advertised auctions of stolen victim data and appeared to support ransomware-related extortion.
In early February, Belgian police seized Cryakl command-and-control servers. The seizure later enabled recovery of private keys used to support decryption for several Cryakl versions.
Deutsche Telekom reported that Crykal was rebranded as CryLock in 2020. The family continued operating under a ransomware-as-a-service model with affiliates deploying the malware.
Deutsche Telekom stated that Crykal infrastructure was taken down in 2018 and that a decryptor was subsequently published. This marked a disruption of the earlier Crykal operation before its later rebranding.
Kaspersky observed a 2016 Cryakl modification distributed as a script for a popular Russian accounting program and a business process management tool. The lure told employees to update the bank classifier by opening an attached executable file.
Check Point found that between March and April 2015, the ransomware's file version schema changed by adding a CL prefix and restarting version numbers. Around April 2015, the encrypted file naming format also changed from retaining original filenames to using random filenames.
Kaspersky reported that Trojan-Ransom.Win32.Cryakl.bo was detected in October and delivered through a phishing campaign using a redirected link to download Attachment.zip. The dropper installed both Cryakl and the Ruftar password stealer, while the ransomware sent victim data to attacker infrastructure via HTTP POST.
On September 22, attackers distributed the Trojan-Ransom.Win32.Cryakl.ax variant to nearly 500 users within a single hour. This was highlighted as part of the late-September Cryakl spam wave.
Kaspersky reported that Cryakl infection attempts peaked in the last week of September at nearly 600 attacks per day, with most activity in Russia and additional victims in Germany, Kazakhstan, Ukraine, and Belarus. The campaigns used phishing emails impersonating the Supreme Arbitration Court of the Russian Federation.
Check Point reported that the first reported reference to this ransomware family appeared in June 2014. The family would later be associated with Cryakl/CryLock lineage in other reporting.
Kaspersky stated that the first Cryakl family sample was added to its databases on April 29, marking the early documented appearance of the ransomware family later also called Fantomas. Other references describe Cryakl's first observed attacks as occurring in 2014.
Deutsche Telekom investigated a case in which a CryLock affiliate encrypted a victim environment and displayed a startup legal notice threatening sale of stolen files. The notice referenced a Tor address associated with LOCKDATA Auction and linked to Search_keys_CryLOCK_3.0.exe hosted on a cloud provider.
After receiving Cryakl private keys from Belgian police, Kaspersky updated its free RakhniDecryptor tool. The update enabled recovery of files encrypted by several Cryakl ransomware versions.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 14 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
5 references tracked. Mallory keeps watching after this page renders.
telekom.com
Open sourcesecurelist.com
Open sourceblog.checkpoint.com
Open sourcesecurelist.ru
Open sourcevirusinfo.info
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **Cl0p** ransomware operation used data stolen through the Accellion File Transfer Appliance compromise to extort dozens of organizations, escalating pressure by emailing victims’ customers directly and threatening publication on its **CL0P^-LEAKS** site. Reporting and threat research describe a highly organized group that demanded multimillion-dollar payments, offered time-based discounts, and in some cases removed victims from its leak portal after payment, while uncertainty remained over whether Cl0p conducted the initial Accellion intrusion or primarily monetized the stolen data. Security researchers linked Cl0p to **TA505/FIN11** activity, citing years of overlapping phishing, malware delivery, and ransomware deployment patterns. Prior campaigns used mass email lures, malicious Excel **XLM macros**, custom packers, and tailored Cl0p binaries compiled per victim with unique RSA keys and individualized ransom notes, suggesting direct operator control rather than a typical affiliate-only model. Analysts also noted Tor-based negotiation portals, double-extortion tactics combining encryption with data theft, and operational patterns consistent with a mature financially motivated criminal enterprise believed to avoid infecting systems configured for Russian or other CIS language settings.
Aug 15, 2026
International law enforcement agencies said **Operation Cronos** disrupted LockBit, the ransomware-as-a-service group long described as the world’s most prolific ransomware operation. Authorities seized infrastructure, took control of LockBit’s leak site and platform, exposed affiliates, delivered decryption keys to victims, and publicly revealed that the group sometimes retained stolen victim data and failed to provide working decryptors. According to the FBI, LockBit operated from 2020 to 2024, hit more than **2,500 organizations** in at least **120 countries**, and collected more than **$500 million** in ransom payments; several members have since been arrested or charged, while alleged leader **Dmitry Yuryevich Khoroshev** remains indicted, sanctioned, and at large.
Jul 28, 2026
LockBit grew from an early ABCD ransomware strain into one of the most prolific ransomware-as-a-service operations, combining fast multithreaded encryption, **double extortion**, and affiliate-driven intrusions against corporate victims worldwide. Researchers and incident reporting tied the group to tactics including UAC bypasses, shadow-copy deletion, log clearing, network-share encryption, and later campaigns using evasive multi-stage loaders, Safe Mode persistence, and password-protected payload delivery. The operation also recruited insiders for direct access to enterprise networks, soliciting VPN, RDP, and email credentials and offering large payouts to employees willing to run malware inside their organizations. LockBit’s criminal ecosystem evolved alongside broader ransomware market shifts, with reporting linking it to affiliate churn, code overlap with other families, and adoption of a modified Conti-based payload branded as **LockBit Green**. By 2023, analysts reported infrastructure and leak-site reliability problems that frustrated affiliates, even as the gang remained tied to major incidents such as the Royal Mail attack. In 2024, Operation Cronos disrupted LockBit infrastructure and seized decryption keys, and U.S., U.K., and Australian authorities later sanctioned and charged Russian national **Dmitry Yuryevich Khoroshev** as the alleged leader, saying LockBit hit more than 2,500 victims in at least 120 countries, collected at least **$500 million** in ransom, and caused billions in wider losses.
Aug 15, 2026