crazyhunter
Active since 2025-03-05
Unverified threat-actor claim — not a regulatory filing
Attribution, victim identity, and counts shown here derive from crazyhunter's public extortion-blog claims, aggregated by ransomware.live. They have not been validated by the victim or any regulator. Treat them as the threat actor's assertion until a regulatory filing or victim disclosure corroborates them.
According to ransomware.live, the group claims:
CrazyHunter is a Go-based ransomware group that emerged in early 2025, derived from the open-source Prince encryptor, exclusively targeting Taiwanese organizations in healthcare, education, and industrial sectors using BYOVD techniques and tools like SharpGPOAbuse for lateral movement.
Source: Ransomware.live