Crypt Ghouls
Crypt Ghouls is a cybercriminal ransomware group identified by Kaspersky that has targeted Russian businesses and government agencies, including organizations in mining, energy, finance, retail, and the public sector. Researchers assessed the group’s goals as both operational disruption and financial gain. Observed initial access involved abuse of compromised contractor or subcontractor credentials to connect to victim environments via VPN, including connections traced to Russian hosting provider infrastructure and contractor networks. After access, the group maintained persistence and remote access using NSSM and Localtonet, and also used AnyDesk and resocks. Its post-compromise activity included credential theft, reconnaissance, and lateral movement. Reported tooling includes XenAllPasswordPro, Mimikatz, a renamed PowerShell ticket-dumping script (dumper.ps1), MiniDump tooling, PingCastle, SoftPerfect Network Scanner, WMI, Impacket WmiExec.py, PsExec, and PAExec. Researchers also observed a CobInt backdoor loader delivered as the VBScript Intellpui.vbs, which executed obfuscated PowerShell to load CobInt in memory. Additional activity included attempts to dump NTDS.dit and collection of browser-stored credentials. For impact, Crypt Ghouls deployed LockBit 3.0 on Windows systems and Babuk on Linux and ESXi systems. On ESXi, the attackers connected over SSH, uploaded Babuk, and encrypted files within virtual machines. The LockBit 3.0 sample was reported to encrypt local drives, terminate selected processes and services, disable Windows Defender, delete event logs, and exclude certain directories from encryption. Victims were instructed to contact the attackers via the Session messaging service. Kaspersky reported substantial overlaps in tools, file naming, infrastructure, and TTPs with MorLock, and additional overlaps with BlackJack, Twelve, and Shedding Zmiy/(Ex)Cobalt-linked activity. The report states these overlaps likely indicate collaboration, shared tooling, or intelligence exchange among multiple groups targeting Russian organizations. Known alias: crypt_ghouls.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Energy
- Banks
- Consumer Discretionary Distribution & Retail
- Government & Administration
Where they target
Geographies tied to known operations.
- 🇷🇺 Russia
Tradecraft
30 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
11 malware families attributed to this actor across reporting.
6 additional families tracked in Mallory.
Observables
16 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Ransomware-focused group targeting Russian businesses and government agencies, using compromised contractor VPN credentials, credential theft, WMI/RDP-based lateral movement, reconnaissance utilities, and deploying LockBit 3.0 on Windows and Babuk on Linux/ESXi systems.
Ransomware intrusion activity leveraging compromised contractor/subcontractor credentials (VPN initial access), followed by lateral movement/persistence tooling and deployment of LockBit 3.0 (Windows) and Babuk (Linux/ESXi) to encrypt victim data.
Ransomware-driven disruptive and financially motivated intrusions against Russian government and commercial organizations, using compromised contractor VPN credentials for initial access, followed by credential theft, remote access tooling, lateral movement, and deployment of LockBit 3.0 (Windows) and Babuk (Linux/ESXi).
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.