Loading threat actor…
CRYSTALRAY is a cybercrime threat actor associated with large-scale opportunistic exploitation of internet-facing services. The actor emerged from activity previously tracked around the SSH-Snake worm and expanded into a broader campaign cluster focused on mass scanning, vulnerability exploitation, credential theft, persistence, lateral movement, and cryptomining. Reported operations have affected more than 1,500 victims and show a strong emphasis on automation and reuse of open-source offensive tooling. CRYSTALRAY conducts reconnaissance and scanning at scale, including country-targeted enumeration of exposed services and validation of discovered hosts before exploitation. Observed targeting has included enterprise applications and middleware such as Confluence, ActiveMQ, Metabase, WebLogic, Solr, Openfire, RocketMQ, and Laravel deployments, with exploitation of known vulnerabilities including CVE-2022-44877, CVE-2021-3129, and CVE-2019-18394. The actor has been observed modifying public proof-of-concept exploits to add malicious payload delivery rather than developing bespoke exploit chains. Following initial access, CRYSTALRAY establishes persistence through backdoors and reverse-shell infrastructure, including use of Sliver-generated implants and Platypus-managed access. The actor has also used SSH-Snake for lateral movement and propagation through compromised environments by harvesting SSH credentials and related artifacts. Credential theft is a central feature of the operation: CRYSTALRAY has been observed collecting secrets from environment files and shell histories, including cloud and SaaS credentials, and is assessed to monetize stolen access through criminal marketplaces and Telegram channels. Additional post-compromise behavior includes exfiltration of collected credential material, deployment of cryptominers, persistence via scheduled tasks and service mechanisms, and termination of competing miner processes to retain exclusive use of victim resources. Known aliases and related tracking include SSH-Snake activity associated with the same campaign cluster. CRYSTALRAY is best characterized as a financially motivated cybercrime actor that combines commodity tooling, scalable internet-wide targeting, credential theft, and resource hijacking.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
5 malware families attributed to this actor across reporting.
1 indicator attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Large-scale opportunistic scanning and exploitation campaign leveraging open-source security tools (e.g., ProjectDiscovery tooling, SSH-Snake) to compromise internet-exposed services, deploy backdoors (Sliver/Platypus/emp3ror), steal and exfiltrate credentials (including cloud/SaaS), and run cryptominers while maintaining persistence.
CRYSTALRAY is a new cybercrime group targeting over 1500 victims for credential theft and cryptomining, using mass scanning, multiple exploits, and open-source security tools.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.