Full Report
It's 'built to be operated by a human with no technical background'
Analysis Summary
# Tool/Technique: CRPx0
## Overview
CRPx0 is a sophisticated Ransomware-as-a-Service (RaaS) and "Hacking-as-a-Service" (HaaS) platform that emerged in mid-2024. It is specifically designed for low-skill threat actors, featuring a "point-and-click" web dashboard that automates complex tasks such as initial access, lateral movement, data exfiltration, and ransomware deployment. The platform utilizes "ClickFix" social engineering tactics to trick users into executing malicious commands on both Windows and macOS systems.
## Technical Details
- **Type:** Ransomware-as-a-Service (RaaS) / Hacking-as-a-Service (HaaS)
- **Platform:** Windows, macOS
- **Capabilities:** Database extraction, full domain compromise, credential theft, crypto-wallet draining, and file encryption.
- **First Seen:** June 2024 (Operations expanded significantly by August 2026).
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566.002 - Phishing: Spearphishing Link] (ClickFix lures)
- **[TA0002 - Execution]**
- [T1059.001 - Command and Scripting Interpreter: PowerShell]
- [T1059.004 - Command and Scripting Interpreter: Unix Shell]
- [T1204.002 - User Execution: Malicious File]
- **[TA0008 - Lateral Movement]**
- [T1047 - Windows Management Instrumentation]
- [T1053.005 - Scheduled Task/Job: Scheduled Task]
- **[TA0010 - Exfiltration]**
- [T1041 - Exfiltration Over C2 Channel]
- **[TA0040 - Impact]**
- [T1486 - Data Encrypted for Impact]
## Functionality
### Core Capabilities
- **Multi-Platform Support:** Deploys Python-based ransomware on Windows (via PowerShell/DLL) and macOS (via curl|bash).
- **ClickFix Lures:** Uses fake "Windows Update" or "Google reCAPTCHA" prompts to trick users into pasting commands into the Run dialog or Terminal.
- **Automated Ransomware:** A 1,769-line Python script that encrypts files using AES-128-CBC (Fernet) after exfiltrating high-value data.
- **White-Label Customization:** Affiliates can bring their own branding to the negotiation panels and malware.
### Advanced Features
- **Offensive Control Center (v3.0):** A centralized web dashboard for managing compromised machines with a "dark-themed" interface.
- **Automated Attack Reactions:** Scripts that trigger automatically when specific "valuable" events occur on a target machine.
- **Stealth Lateral Movement:** Uses `schtasks` and WMI to propagate across the network.
- **Evasion Rules:** Hardcoded prohibition against attacking Commonwealth of Independent States (CIS) member countries.
## Indicators of Compromise
- **File Extensions:** `.crpx0`
- **Registry Keys:** `HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU` (Look for entries containing `powershell`, `curl`, or long Base64 strings).
- **Network Indicators:**
- `crpx0[.]su` (Leak site/C2 infrastructure)
- `crpx0[.]su/haas`
- `crpx0[.]su/v3.txt`
- **Behavioral Indicators:**
- Unauthorized use of `schtasks.exe` or `wmic.exe` for remote execution.
- Large volume data transfers (exfiltration) prior to encryption activity.
- Execution of `curl | bash` commands on macOS endpoints.
## Associated Threat Actors
- **CRPx0 Crew:** The primary developers and operators.
- **Affiliates:** Various low-technical-background actors recruited via clear-web forums.
## Detection Methods
- **Behavioral Detection:** Monitor for "Run" dialog abuse where users paste Base64-encoded PowerShell commands.
- **Endpoint Monitoring:** Alert on the deployment of portable Python environments in non-standard directories (used to run the ransomware script).
- **Registry Auditing:** Monitor `RunMRU` keys for high-fidelity indicators of ClickFix lures.
## Mitigation Strategies
- **User Permissions:** Remove the "Run" dialog access for standard (non-admin) users on Windows.
- **Application Control:** Restrict access to Terminal/Shell for non-technical staff via MDM on macOS.
- **Network Filtering:** Block known CRPx0 domains and monitor for unusual traffic to Monero-related services.
- **Backup Hardening:** Ensure backups are stored off-site or in immutable formats that are unreachable via standard compromised user credentials.
## Related Tools/Techniques
- **ClickFix:** The broader social engineering technique involving fake browser/system update prompts.
- **Python-based Ransomware:** Similar to variants like **Snake/Sovereign** or **Petya** (in terms of being scripted).
- **RaaS Platforms:** Similar to **LockBit** or **BlackCat**, though CRPx0 focuses more on extreme ease of use for non-technical operators.