CRPx0 Hacking Service Boasts Quintupled Victim Count, Offers White-Label Ransomware
The CRPx0 cybercrime service claims its victim count has surged to 48 organizations, offering a customizable ransomware-as-a-service platform and data extraction tools to aspiring criminals.
The CRPx0 cybercrime operation, which has rapidly transitioned from a simple scam service to a sophisticated ransomware and data theft enterprise over the summer, is now claiming a significant expansion in its victim base. The group asserts that its victim count has jumped from fewer than 10 organizations in June to 48, as listed on its clear-web leak site. While the veracity of such claims from criminal entities should always be viewed with skepticism, the expanding operations, unique payload delivery, and white-label hacking service offered by CRPx0 make it a notable player in the cybercrime landscape.
Researchers have identified CRPx0 as a comprehensive hacking service that provides affiliates with tools for "complete database extraction" from targeted organizations, with optional public data leak coordination. The platform also advertises full network compromise capabilities, encompassing initial access, lateral movement, and complete domain control, along with mechanisms for maintaining persistent access across a victim's infrastructure. This all-encompassing approach aims to equip less technically skilled criminals with powerful offensive capabilities.
Adding to its appeal for aspiring cybercriminals, CRPx0 operates a white-label ransomware-as-a-service (RaaS) platform. This service allows affiliates to brand the operation as their own, with CRPx0 handling the setup and maintenance of critical infrastructure, including command-and-control servers, negotiation panels, and the malware itself. Initially, the service was offered for a $10,000 one-time fee with affiliates retaining 100 percent of their profits, a highly unusual model in the RaaS ecosystem. This has since been adjusted to a 70-30 split, where affiliates receive 70 percent of extortion payments after paying a $333 enrollment fee, with the remaining 30 percent going to CRPx0 operators.
CRPx0 enforces a common restriction among Russia-aligned ransomware operations: affiliates are prohibited from targeting organizations within Commonwealth of Independent States (CIS) member countries. This aligns with a widely observed practice in the cybercrime world, often referred to as the "first rule of ransomware club." The group also shows a preference for Monero (XMR) over Bitcoin for ransom payments, likely for enhanced anonymity.
The ClickFix ransomware, a core component of CRPx0's offering, can be delivered through customizable social engineering lures. Affiliates can deploy fake Windows Update prompts or deceptive Google reCAPTCHA pages to trick victims into executing malicious commands. The Windows lure, for instance, prompts a victim to paste a PowerShell command into the Run dialog, initiating a chain of events that ultimately deploys the Python-based ransomware. The macOS lure utilizes a curl|bash command to download a portable Python interpreter and the ransomware directly.
According to research from Ransom-ISAC, the CRPx0 malware suite supports multiple payload formats, including two HTML lures, a standalone DLL, and a standalone EXE. Regardless of the delivery method, all payloads deploy the same ransomware: a Python script designed to exfiltrate high-value files before encrypting them using AES-128-CBC. The malware employs WMI and schtasks for lateral movement, and victims are typically given a 48-hour deadline to pay the ransom before their stolen data is leaked.
In a recent v3.0 update posted on their leak site, CRPx0 operators announced "a complete, professional offensive control center for managing compromised remote machines from a single web dashboard." This enhanced control panel offers tools for stealing credentials, cryptocurrency wallet keys, and monitoring stolen funds, alongside scripts for remote command execution and automated attack responses. The interface is designed for users with no technical background, featuring "point-and-click panels, plain-language rules, and clear status indicators."
Defenders are advised to implement several key measures to counter CRPx0 and similar threats. Prioritizing the removal of the Run dialog for standard users can block the Windows delivery path entirely. For macOS users, restricting Terminal access via MDM is recommended. Additionally, security teams should set up alerts for RunMRU writes containing PowerShell, curl, or long base64 strings, as this activity is a high-fidelity indicator of ClickFix-class attacks.