CRPx0 gang claims victim count more than quintupled

CRPx0 is a cybercrime crew that The Register describes as having evolved rapidly, over the summer of 2026, from a scam service into a ClickFix-delivered ransomware and crypto-theft operation. On its own clear-web leak site, CRPx0 claims its victim count grew from fewer than 10 organizations in June to 48 by the time of this article's publication on August 27, a jump the source's own headline calls more than a quintupling. The Register frames that number with explicit caution: it is a criminal group's self-reported figure, posted on its own site, and not independently verified by any of the researchers cited in the piece.

CRPx0 runs two separate offerings. The first is a straight hacking-for-hire service: 'complete database extraction' from a victim organization, with 'optional public leak coordination upon request,' plus full network compromise 'from initial access, through lateral movement, to full domain compromise,' and persistent access across the victim's infrastructure.

The second, and the one driving CRPx0's growth, is a white-label ransomware-as-a-service platform that builds and hosts everything an affiliate needs, including command-and-control infrastructure, a negotiation panel and the malware itself, so criminal customers can rebrand the operation as their own. CRPx0 originally charged a one-time $10,000 fee for that platform and let affiliates keep 100 percent of what they extorted, an arrangement the article calls unheard of in ransomware-as-a-service operations. That profit split has since moved to a 70-30 model: affiliates now keep 70 percent of extortion payments and CRPx0's operators take 30 percent, joined by a separate one-time $333 enrollment fee. CRPx0's affiliate rules bar attacks on organizations in Commonwealth of Independent States member countries, a carve-out The Register says is common among Russia-based ransomware operations; Recorded Future analyst Allan Liska made a similar point in an earlier interview with The Register, not about CRPx0 specifically, calling that same rule ransomware crime's 'first rule of ransomware club: you don't attack organizations in the Commonwealth of Independent States.' CRPx0 also prefers payment in Monero over Bitcoin.

Affiliates deliver CRPx0's ransomware through ClickFix-style social engineering that tricks victims into running a command themselves. CRPx0 offers two lures for this: a fake Windows Update prompt and a fake Google reCAPTCHA check. On Windows, the lure gets a victim to paste a PowerShell command into the Run dialog, which drops a DLL stager chain that ultimately deploys the Python-based ransomware; on macOS, the lure instead runs a curl-piped-to-bash command that downloads a portable Python interpreter and the ransomware directly. Counting the two HTML-based lures plus a standalone DLL and a standalone EXE that skip the social-engineering step entirely, the Ransomware-ISAC research team, in an analysis published that Thursday, counts four payload formats in total, all delivering the same 1,769-line Python ransomware script. That script steals high-value files first, then encrypts them using AES-128-CBC via the Fernet scheme, moves laterally through a network using WMI and the Windows scheduled-task utility, schtasks, and leaves a ransom note giving victims a 48-hour deadline to pay before the stolen files are leaked.

On August 23, CRPx0's operators posted a version 3.0 update to their leak site promising what they called 'a complete, professional offensive control center for managing compromised remote machines from a single web dashboard.' The update adds tools for stealing files, credentials, and crypto-wallet recovery phrases and keys while 'watching stolen cryptocurrency wallet addresses flow in,' scripts for running remote commands, and automated triggers that fire on their own when something valuable turns up on a target. The operators describe the whole system as built for 'a human with no technical background,' with point-and-click panels, plain-language rules and status indicators sitting on top of the attack engine. Bitdefender threat researcher Jade Brown, in an August 12 analysis, suggested CRPx0's public self-promotion could be a genuine recruiting push for new affiliates, or itself a scam aimed at would-be criminal customers; either way, she warned that other threat actors may copy CRPx0's techniques, and urged organizations to tune detection for both crypto theft and file encryption.

The Ransomware-ISAC team also lays out five prioritized defenses, in order, noting that the first three are free and blunt the entire ClickFix attack class rather than CRPx0 specifically: disabling the Windows Run dialog for standard users and restricting macOS Terminal access for non-technical staff, watching for a specific Windows registry artifact that ClickFix commands leave behind, and blocking the network indicators the team has published. The remaining two address limiting damage after a compromise: hunting for data theft in the window before encryption starts, since CRPx0 exfiltrates files before it encrypts them, and confirming backups are unreachable from any account an attacker could compromise.

Key facts

CRPx0 claims its self-reported victim count grew from fewer than 10 organizations in June to 48 by August 27, a figure The Register explicitly flags as an unverified claim from the criminal group itself, posted on its own leak site.
CRPx0's white-label ransomware-as-a-service platform originally cost a $10,000 one-time fee with affiliates keeping 100 percent of extortion profits; joining now costs a separate one-time $333 enrollment fee under a 70-30 split, affiliates keeping 70 percent and CRPx0's operators taking 30 percent.
Two ClickFix lures, a fake Windows Update prompt and a fake Google reCAPTCHA check, plus two lure-free payloads (a standalone DLL and EXE), all deliver the same 1,769-line Python ransomware, which steals data first, then encrypts it with AES-128-CBC (Fernet) and gives victims a 48-hour deadline.
An August 23 version 3.0 update gave affiliates a point-and-click web dashboard for managing compromised machines, tracking stolen crypto-wallet activity and running automated attack triggers, built, in the operators' own words, for 'a human with no technical background.'
Researchers recommend five ordered defenses; the first three are free and blunt the whole ClickFix attack class, starting with disabling the Windows Run dialog and macOS Terminal access, then alerting on writes to the Windows RunMRU registry key that reference PowerShell, curl or long base64 strings.

Why it matters

CRPx0 shows how quickly a small-scale scam operation can restructure itself into a full ransomware-as-a-service business. It started as a straightforward hacking-for-hire listing, then added a second business line: a white-label ransomware platform that other criminals can rebrand and run under their own name, with a dashboard the CRPx0 team itself says is built for operators with 'no technical background.' The pricing model changed alongside it. The white-label platform originally cost a $10,000 one-time fee, paired with a 100 percent affiliate profit share; joining now costs a separate $333 one-time enrollment fee under a 70-30 split favoring affiliates. A small enrollment fee and an easier interface point to a group optimizing for affiliate volume over per-deal margin, and to a lower skill floor for entering ransomware crime generally. Bitdefender's Jade Brown adds a wrinkle: CRPx0's public self-promotion could equally be a scam aimed at the affiliate hopefuls it claims to recruit, not a genuine growth pitch.

Who it affects

CRPx0's affiliate rules explicitly bar attacks on organizations based in Commonwealth of Independent States member countries, so its declared targets are organizations everywhere else. Its malware runs on both Windows and macOS through separate ClickFix lures, so exposure is not limited to one operating system. The defensive advice in the piece targets IT security teams and defenders broadly, and the researchers say most of it addresses the wider ClickFix technique rather than CRPx0 specifically. The white-label platform's direct customers are the 'wannabe crooks' and affiliate hopefuls CRPx0 is recruiting, some of whom Jade Brown suggests could themselves be the target if CRPx0's recruiting pitch turns out to be a scam.

How to use it

For defenders, this translates into five prioritized actions from the Ransomware-ISAC team, given in order. The first three are free and address the whole ClickFix technique, not just CRPx0. First, remove the Run dialog for standard Windows users, which blocks the Windows infection path outright, and restrict Terminal access via mobile device management for non-technical macOS staff. Second, alert on writes to the Windows registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU that contain powershell, curl or long base64 strings; the researchers call this the highest-fidelity ClickFix detection available and trivial to deploy. Third, block the adversary network indicators the researchers have published. The remaining two limit damage after a CRPx0-style compromise already in progress: fourth, hunt for exfiltration activity in the window before encryption starts, since CRPx0 steals data first and only encrypts afterward, so the .crpx0 file extension and the ransom note appear only after the theft is done; fifth, confirm backups are unreachable from any account an attacker could compromise, and treat anything reachable with a victim's own credentials as already lost.

How solid is it

The Register is a long-running technology and security publication, and this piece carries a named byline, Cybersecurity Editor Jessica Lyons. It draws on several independent sources rather than CRPx0 alone: threat-intel analyst Rakesh Krishnan, who first published details and malware samples on CRPx0 in early August; the Ransomware-ISAC research team's payload and malware analysis; and Bitdefender's Jade Brown. The technical claims, the payload formats, the length and behavior of the ransomware script, the registry artifact it leaves behind, come from that research and are the kind of detail a security team can verify directly. The headline number is a different class of claim: the rise from fewer than 10 to 48 victims comes solely from CRPx0's own leak site, and the article itself flags it as an unverified criminal claim rather than treating it as fact.

Risks and caveats

The 48-organization victim count is CRPx0's own claim, posted on its own leak site, and none of the researchers cited independently verified it; the article itself asks readers to treat criminal self-reporting with skepticism. The piece never states that CRPx0's operators are Russian or Russia-based; it says only that their CIS-exclusion rule is common among Russia-based ransomware operations, a pattern rather than a confirmed attribution. The 'first rule of ransomware club' quote came from an earlier interview Allan Liska gave about that pattern generally, not a comment made specifically about CRPx0. No total dollar figure for ransoms collected or victim losses is given anywhere in the piece, and it does not say whether the original $10,000 white-label platform fee has itself changed, separate from the newer $333 affiliate enrollment fee. No exact founding date for CRPx0 is given, only that its ransomware and crypto-theft business emerged 'over the summer.'

“Everything is built to be operated by a human with no technical background: point-and-click panels, plain-language rules, and clear status indicators. The underlying attack engine is hidden behind a clean, dark-themed interface.”

— CRPx0 operators