Ransomware group profile · #269 by claimed victims

Cry0 ransomware

Cry0 is a ransomware-as-a-service operation that recruits affiliates via underground forums, using a Rust-written payload with blockchain-based (Internet Computer Protocol) negotiation infrastructure to resist law enforcement takedowns and offering affiliates a 90/10 revenue split.

Active First seen Jan 2026

5Victims claimed on leak sites

1Victims in the last 30 days

4Victims in the last 90 days

3Countries hit

2Leak-site URLs tracked, 1 online

9 Oct 2026Latest claim recorded

Victimology

Who Cry0 claims to have breached, from 5 leak-site posts recorded by VULONE.

Claims per month last 12 months

Top sectors

Transportation1

Retail & E-Commerce1

Manufacturing1

Professional Services1

Energy & Utilities1

Top countries

United States2

Italy1

Canada1

Latest claimed victims 5 most recent

Victim	Sector	Country	Claimed
Anaergia \| World-Leading Anaerobic Digestion Solutions	Energy & Utilities	CA	9 Oct 2026
MinMor Industries	Manufacturing	-	28 Sep 2026
Young Injury Law	Professional Services	US	19 Sep 2026
Hope's Windows	Retail & E-Commerce	US	6 Aug 2026
dinisrl.it dinisrl.it	Transportation	IT	6 Jul 2026

All 5 Cry0 victims, searchable

Full victim list with claim posts, domains, timing and exports, plus the negotiation chats and leak-site screenshots VULONE archives for this crew.

Start free Sign in

Tactics, techniques and procedures

ATT&CK technique mapping for Cry0 is in progress. Victimology, infrastructure status and leak-site tracking are live above.

Indicators, detections and the full playbook

Hashes, C2 addresses, onion services, Sigma and YARA detections per technique, and the negotiation transcripts are available to signed-in analysts.

See full IOCs

Frequently asked

Is Cry0 ransomware still active?

Cry0 is tracked as active. The most recent leak-site claim VULONE recorded is dated 9 October 2026. 1 victims were claimed in the last 30 days.

How many victims has Cry0 claimed?

VULONE has recorded 5 leak-site victim claims attributed to Cry0 since July 2026, across 3 countries and 5 sectors.

Which industries does Cry0 target?

The sectors most often named on the Cry0 leak site are Transportation, Retail & E-Commerce, Manufacturing.

Which countries are most affected by Cry0?

Most Cry0 victims recorded by VULONE are located in United States, Italy, Canada.

Where does VULONE get Cry0 victim data?

Claims are collected continuously from the group's own leak sites and cross-checked with ransomware.live and RansomLook. A claim is the group's assertion, not a confirmed breach.

Other ransomware groups

Victim claims are collected from leak sites and enrichment partners (ransomware.live, RansomLook) and represent the group's own assertions, not confirmed breaches. Profile last updated 31 October 2026. Questions or corrections: research@vulone.com.