crazyhunter Ransomware
Tracked since Mar 9, 2025
0
victims recorded
0
in the last 30 days
0
CVEs
—
Last activity
CrazyHunter is a Go-based ransomware group that emerged in early 2025, derived from the open-source Prince encryptor, exclusively targeting Taiwanese organizations in healthcare, education, and industrial sectors using BYOVD techniques and tools like SharpGPOAbuse for lateral movement.
Vulnerabilities cited for this group
CVEs associated with the group by ransomware.live. Records not yet published here appear without a link.
No CVE associated with this group in the sources.
Observed tools
Defense Evasion
Zemana Anti-Rootkit driver · av-1m.exe (AV bypass) · go.exe / go2.exe (BYOVD loader)
Offsec
Donut · Prince Ransomware · SharpGPOAbuse · bb.exe (shellcode loader)
Victims posted on leak sites, according to ransomware.live. Victim names are not displayed. · View on ransomware.live