Loading story…
Researchers detailed the Crytox ransomware family as a multi-stage 64-bit Windows threat that encrypts local and network drives, appends the .waiting extension to files, deletes shadow copies, and drops an HTA ransom note directing victims to negotiate through an embedded uTox messenger client. The malware uses layered AES-encrypted configurations, shellcode-based staging, API hashing, and remote thread or process injection into legitimate Windows processes such as svchost.exe and explorer.exe to evade analysis and execute its payload.
Crytox protects per-file AES-256 encryption keys with RSA material generated or retrieved locally and stores key data in the Windows registry, while also attempting to erase traces by wiping and deleting earlier-stage files. Separate analysis found the ransomware does not appear to rely on data theft for double extortion, but its cryptographic implementation may be flawed because key generation is seeded in part with GetTickCount, potentially enabling brute-force recovery in some known-plaintext cases; one publicly disclosed victim, Dutch media company RTL, said it paid 8,500 euros to the attackers.
TTPs, infrastructure, and targeting history in one profile.
4 events from the most recent confirmed update back to the earliest known activity.
In September 2021, Netherlands-based company RTL publicly acknowledged that it had been compromised by the Crytox threat actor. RTL also said it paid 8,500 euros to the operators.
Crytox was first observed in 2020 as a multi-stage ransomware family targeting Windows systems. The malware encrypts local and network drives, appends the .waiting extension, and uses uTox for victim communication.
Zscaler ThreatLabz published an analysis of Crytox describing its layered anti-analysis techniques and encryption design. The report highlighted that Crytox's RSA key generation relies on a weak pseudo-random process partly seeded by GetTickCount, potentially enabling decryption in some cases.
K7 Labs published a technical analysis describing Crytox as a 64-bit Windows ransomware family commonly packed with UPX. The report detailed its staged AES-protected configurations, process injection, shadow-copy deletion, registry-stored key material, and file encryption workflow.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 11 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **Cryakl** ransomware family, also known as **Fantomas**, **Crykal**, and later **CryLock**, developed from early spam-driven attacks into a broader ransomware operation that encrypted files without needing live command-and-control communication and increasingly relied on affiliate-style distribution. Early campaigns targeted victims primarily in Russia, with additional activity in Germany, Kazakhstan, Ukraine, Belarus, Japan, and Italy, using phishing emails and malicious archives to deliver Delphi-based malware that encrypted portions of files, stored metadata locally, persisted through Windows registry keys, and in some cases installed the password-stealing trojan **`Trojan-PSW.Win32.Ruftar`** alongside the ransomware. Researchers also documented versions that used layered encryption with locally generated keys and hardcoded remote RSA public keys, allowing attackers to extort victims without any online key exchange. The operation later adopted tactics associated with modern **double extortion**. Deutsche Telekom linked at least one intrusion to a CryLock affiliate that encrypted a victim environment, displayed a pre-login legal warning, and threatened to publish stolen data through the **LOCKDATA Auction** leak marketplace, underscoring the shift from pure encryption to data-theft coercion. Separately, Belgian police seized Cryakl command-and-control servers and obtained private keys that enabled Kaspersky to expand decryption support in **RakhniDecryptor**, helping victims recover files from several Cryakl variants and disrupting one of the more prominent ransomware families active in Russia.
Aug 15, 2026
TeslaCrypt emerged as a fast-moving ransomware family that encrypted both common user documents and game-related files, including saved games and Steam-related data, expanding its impact to PC gamers. Initial infections were linked to malicious email attachments and exploit kits such as **Angler**, which abused browser and plugin flaws including Adobe Flash `CVE-2015-0311`; later distribution was also tied to **Sweet Orange** and **Nuclear** via compromised websites. The malware deleted Volume Shadow Copies, contacted command-and-control infrastructure, and used ransom notes and recovery files to pressure victims into paying in Bitcoin. Later TeslaCrypt variants significantly hardened their cryptography and extortion workflow. Researchers reported that early versions falsely claimed to use **RSA-2048** while actually relying on `AES-CBC-256`, with key material stored locally in files such as `key.dat`, allowing decryption in some cases and enabling Cisco Talos to release a recovery utility when the necessary keys were present. TeslaCrypt 2.0, however, adopted a stronger design using **ECDH** over `secp256k1` with `AES-256-CBC`, moved key-related data into the Windows registry, generated unique Bitcoin addresses per victim, appended the `.zzz` extension to encrypted files, and replaced its interface with an HTML ransom page modeled on **CryptoWall**, making recovery without attacker-controlled key material far more difficult.
Aug 15, 2026
Sophos reported that the **WantToCry** ransomware is targeting internet-exposed SMB services on ports `139` and `445`, using weak, brute-forced, or stolen credentials to access shared files without deploying malware on the victim host. Instead of encrypting data locally, the attackers copy files over authenticated SMB sessions to attacker-controlled servers, encrypt them remotely, and write the encrypted versions back to the original shares, appending the `.want_to_cry` extension and dropping ransom notes such as `!want_to_cry.txt` or `!Want_To_Cry.txt`. The notes direct victims to qTox or Telegram and typically demand about **$600 in Bitcoin**. Researchers said the technique reduces traditional endpoint detection opportunities because it leaves few host-based artifacts and relies on seemingly normal SMB file operations, though network and authentication traces remain visible. Sophos linked the activity to infrastructure in **Russia, Germany, the United States, and Singapore**, including systems previously associated with **NetSupport RAT** and **LockBit, Qilin, and ALPHV/BlackCat** activity, while noting the ransomware is unrelated to the 2017 **WannaCry** worm despite the similar name. The company said the attacks appear focused on hosts exposing SMB rather than broad enterprise-wide deployment and urged organizations to block inbound SMB, disable **SMBv1** and anonymous access, monitor unusual external SMB activity, and protect backups from SMB-based access.
Jun 29, 2026