Red Hot Cyber
Cybersecurity is about sharing.
Recognize the risk, combat it, share your experiences,
and encourage others to do better than you.
Pietro Melillo : 10 March 2025 15:04
In the reconnaissance of the world of the underground and criminal groups carried out by Red Hot Cyber’s DarkLab threat intelligence lab, we came across a Data Leak Site of a cyber gang that had never been monitored before: Crazyhunter.
With a distinct identity and a manifesto that sets it apart from other cybercriminal actors, Crazyhunter presents itself as a sophisticated operation that focuses on attack speed, data destruction, and a highly structured criminal branding system.
From the information gathered on their Data Leak Site (DLS), accessible through the Tor network, the group appears to adopt a methodical and aggressive approach, aimed at compromising corporate security in the shortest time possible. With a ransom negotiation and management system that includes “demonstrations” of their destructive capabilities, Crazyhunter distinguishes itself through a business model that emphasizes mathematics, advanced encryption, and even blockchain technology to record their decryption “promises.”
Vorresti toccare con mano la Cybersecurity e la tecnologia? Iscriviti GRATIS ai WorkShop Hands-On della RHC Conference 2025 (Giovedì 8 maggio 2025)
Se sei un ragazzo delle scuole medie, superiori o frequenti l'università, oppure se solamente un curioso, il giorno giovedì 8 maggio 2025 presso il teatro Italia di Roma (a due passi dalla stazione termini e dalla metro B di Piazza Bologna), si terranno i workshop "hands-on", creati per far avvicinare i ragazzi alla sicurezza informatica e alla tecnologia. Questo anno i workshop saranno:
Supporta RHC attraverso:
Ti piacciono gli articoli di Red Hot Cyber? Non aspettare oltre, iscriviti alla newsletter settimanale per non perdere nessun articolo.
Crazyhunter’s Tor portal is divided into multiple sections, featuring a minimal but functional design:
Based on information from their strategic manifesto, Crazyhunter positions itself as a highly technical operation with several distinctive characteristics that make it particularly dangerous:
Crazyhunter claims to breach victim security in less than 72 hours, leveraging:
This suggests that the group exploits zero-day or well-selected N-day vulnerabilities, in addition to advanced evasion tactics, which may include polymorphic malware and fileless attack techniques.
Crazyhunter doesn’t just encrypt data; it introduces a three-layer data annihilation concept:
This combination of advanced encryption, total data destruction, and reputation threats makes Crazyhunter a unique actor, blending traditional ransomware with psychological coercion methods.
Crazyhunter also introduces a new concept in the ransomware world: criminal branding. Among the services they offer:
Finally, their strategic manifesto highlights that the group does not consider itself as “greedy” as REvil or “too loud” as LockBit, and states that they focus on only three things:
The last point suggests that Crazyhunter may be using a public or private blockchain to track completed operations, perhaps to demonstrate to future victims that they keep their word when it comes to providing decryptors after payment.
An analysis of the victim list on Crazyhunter’s DLS reveals that the group has primarily targeted Taiwanese organizations, focusing on:
The inclusion of hospitals and academic institutions suggests an opportunistic targeting strategy, where the likelihood of ransom payment is high due to the sensitivity of the data involved. However, it is possible that the group will expand its scope to other sectors in the coming months.
Crazyhunter is not just another ransomware group. Unlike other operations that focus solely on file encryption, this group introduces additional pressure tactics, including:
Although it is still too early to assess its full impact, Crazyhunter has already demonstrated its ability to target high-profile organizations and maintain a highly strategic operational model. The combination of advanced exploits, sophisticated encryption, and psychological coercion tactics makes it an emerging threat that should not be underestimated.
For businesses, the lesson is clear:
Traditional ransomware defenses are no longer enough. The new generation of cybercriminals is refining increasingly destructive and difficult-to-counter strategies.
Pietro Melillo