crazyhunter

Executive Summary

CrazyHunter is a newly emerged ransomware group utilizing Go-based tools and targeting Taiwanese organizations in healthcare, education, and industrial sectors. They employ BYOVD techniques and lateral movement tools like SharpGPOAbuse, aligning with their financial-gain motivation. Their activities are confined to a short operational window in March 2025.

Goals & Targeting

CrazyHunter's strategic objectives are centered on financial gain, achieved through the deployment of ransomware. Their targeting is geographically and sector-specific, focusing on Taiwan due to potential high ransom demands in healthcare and industrial sectors. The group likely selects victims based on their ability to disrupt operations while ensuring payout feasibility.

CrazyHunter is a medium-sophistication ransomware group that emerged in early 2025, leveraging the open-source Prince encryptor as a foundation. Specializing in targeting Taiwanese organizations within healthcare, education, and industrial sectors, they have demonstrated a clear focus on financial gain through encryption-based attacks. Their operational methods include the use of Bring-Your-Own-Virus Device (BYOVD) techniques for initial access and lateral movement via SharpGPOAbuse, indicating a preference for sophisticated yet common attack vectors. With 10 known victims to date, CrazyHunter appears to be a focused group targeting sectors with high potential for ransom payouts or sensitive data.

Key Capabilities

• Go-based ransomware
• BYOVD techniques
• SharpGPOAbuse for lateral movement
• Leveraging open-source tools

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

CrazyHunter's campaign activity is brief, primarily observed in March 2025. Their focus on Taiwanese sectors suggests a regional targeting strategy with potential for expansion. The group appears to target organizations with weaker security postures, particularly those lacking robust backup and incident response plans.

IOC Patterns

• Use of BYOVD techniques
• Leverage GPOs for lateral movement
• Encrypted communications via custom tools

Recommended Actions

• Harden GPO configurations
• Monitor for suspicious GPO changes using System Monitored Attack (Sysmon)
• Segment networks to limit lateral movement potential
• Educate employees on phishing and BYOVD risks
• Implement robust backup solutions and regular testing

Suggested Tags