Imagine a thief who doesn't break a window or pick a lock. Instead, they put on a uniform, use a master key, and calmly walk right past the security guards. That’s the terrifying new reality of cyberattacks, and a group called Crypto24 are the masters of this disguise.
Their secret weapon is to abuse the very tools that already exist on your computer, the legitimate, trusted software that security systems are trained to ignore. This allows them to bypass high tech defences (like EDR) and pull off incredibly stealthy attacks.
This isn't a generic threat. This is a targeted, intelligent heist happening in slow motion. Crypto24’s strategy is simple: They sneak into the workshop and use your own tools against you.
Why Should We Care?
Crypto24 is blending legitimate tools with custom malware. This clever mix allows them to slip past security measures and launch stealthy attacks on unsuspecting victims. Ransomware attacks can lock you out of your own files, demanding payment to regain access. This can lead to significant data loss, financialstrain, and even reputational damage for businesses. The fact that Crypto24 canbypass Endpoint Detection and Response (EDR) systems makes it even more concerning. EDR tools are designed to detect and respond to such threats, but Crypto24 has found ways to evade them.
Who is the Target?
- Medium to Large Businesses: Especially those with complex networks.
- Government Agencies and Hospitals: Organizations with critical data that can't afford downtime.
- Any Organization Using EDR/Advanced Security: Because this tactic is designed specifically to bypass those very defences.
The Heist: A Simple Breakdown
- The Disguise : They first gain access using stolen passwords or by exploiting a vulnerability. They look like a legitimate user.
- Hiding in Plain Sight: Instead of flashy malware, Crypto24 starts with trusted tools that many IT teams already use like PSExec, AnyDesk, and Windows utilities like net.exe and gpscript.exe. They use built-in Windows tools like PowerShell and Windows Management Instrumentation (WMI) to explore the network, find valuable data, and move to other computers. Because these are Microsoft's own tools, many security systems give them a free pass
- The Payload : Once they’re in position and know exactly what to hit, they finally deploy their piece of custom malware , the ransomware itself. It's like they did all the planning with your tools and only brought in one tiny, specialized lock pick to do the final damage.
- The Escape : They encrypt all the files and demand a ransom. Because they were so stealthy, they often aren't detected until it's far too late.
How Can We Fight Back
· Watch for Strange Behaviour : Monitor Tool Usage, new or re-enabled admin accounts, Keep an eye on unusual activities in your network and odd scheduled tasks and services, Track data being sent to unusual cloud locations. If something seems off, investigate it immediately.
· Implement the "Principle of Least Privilege". Users (and applications) should only have the minimum level of access they need to do their job. This limits how far an attacker can move if they get in. Limit use of certain IT tools like gpscript.exe, PSExec, or AnyDesk
· Enhance Your Security Measures: Ensure your security software is up to date. Use a comprehensive solution that includes real-time protection against ransomware and other threats.
· Regular Backups: Regularly back up your important files to an external drive or cloud storage. In the event of a ransomware attack, having backups can assist with data recovery .
· The goal is no longer to just "block bad stuff." It's to create a environment where even if an attacker gets inside, their strange behaviour is quickly spotted, their movement is limited, and our most valuable assets are safely out of reach.
.png)
.png)