Crypto24 Ransomware Group – EDR Bypass
Crypto24 ransomware attacks enterprises using stealth EDR evasion and custom malware.
Crypto24 ransomware wreaks havoc on enterprise networks with stealth EDR evasion
Organizations across multiple sectors are grappling with attacks from theCrypto24 ransomware group, known for their sophisticated stealth techniques and EDR evasion. First observed in September 2024, Crypto24 has been leveraging legitimate Windows tools combined with custom malware to bypass security defenses and escalate privileges.Trend MicroandBleepingComputerconfirm that large-scale campaigns have already targeted financial, healthcare, and logistics networks.
During initial compromises, attackers execute discovery commands to map system configurations and accounts:
This allows them to enumerate users, groups, and hardware details before moving further.
Persistence
Persistence is established via scheduled tasks and malicious services:
- Batch and scripts in %ProgramData%\Update\ (update.vbs, vm.bat) run at regular intervals
- Services are created with sc.exe to deploy a keylogger (WinMainSvc) and the ransomware itself (MSRuntime) for long-term system control
Privilege escalation
Privilege escalation follows usingrunas.exeandPsExec, adding accounts to administrators and launching remote shells:
- net.exe localgroup administrators username /add
- runas.exe /user:administrator cmd
- $mytemp$\low\psexec64.exe -u -p cmd
This ensures attackers can operate with high-level access across systems.
Defense Evasion: Impair Defenses – RealBlindingEDR
The attackers leverageRealBlindingEDRto disable security products and evade detection.
RealBlindingEDR targets and clears several kernel-level callbacks, including:
- Callbacks registered via CmRegisterCallback(Ex)
- MiniFilter driver callbacks
- Callbacks registered via ObRegisterCallbacks()
- Process creation and thread creation callbacks via PsSetCreateProcessNotifyRoutine(Ex) and PsSetCreateThreadNotifyRoutine(Ex)
- Image load callbacks via PsSetLoadImageNotifyRoutine(Ex)
By removing these kernel callbacks, the tool enables three main effects against AV/EDR solutions:
- Blinding AV/EDR: It prevents monitoring of processes, threads, file operations, registry changes, and high-privilege handle acquisition, while allowing the AV/EDR process to continue running to avoid detection due to sudden disconnection.
- Permanent AV/EDR disablement: With registry and MiniFilter notifications removed, AV/EDR can be permanently disabled—even after a system reboot—by modifying the registry or deleting AV/EDR files.
- Termination of AV/EDR processes: Removal of object handle callbacks allows normal administrator accounts to terminate AV/EDR processes directly.
Lateral Movement
Lateral movement is achieved with PsExec and remote services, while credential theft is performed by the keylogger WinMainSvc.dll, deployed via run_new.bat. TightVNC installation ensures persistent remote access and continued data capture, including credentials and sensitive files.
Evolving Threats
This campaign highlights how modern ransomware combines traditional attack techniques with custom malware and EDR evasion, posing severe operational and reputational risks. Therefore, companies must continuously evolve and adapt their cybersecurity strategies to effectively counter these threats.
Where to focus for monitoring rules:
For effective monitoring, attention should be on anomalous remote connections, unusual process execution patterns, EDR bypass attempts, and new user account activity. Observing these indicators allows teams to detect attacks early, respond promptly, and minimize operational impact without requiring deep technical investigation for every alert.
Phishing-Driven Threats
This campaign demonstrates how highly dangerous ransomware often leverages phishing as its primary infection vector. The combination of sophisticated malware and EDR evasion significantly increases operational and reputational risks. Therefore, companies must ensure that all employees, regardless of their sector, are well-informed and aware of these threats, fostering a culture of caution and vigilance to prevent accidental infections.
Stay Informed. Stay Secure.
Next step
Want this looked at in your own estate?
Thirty minutes with an analyst, not a salesperson. We will tell you whether it matters to you and what to do first.
Related insights
How Alert Fatigue Destroys Security Teams — and How Managed SOC Solves It
The modern SOC is drowning. Industry research consistently reports that organisations receive thousands of security alerts per day, that the majority are false positives, and that analysts are leaving the profession faster than the industry can replace them. Alert fatigue is not a minor inconvenience — it is a structural vulnerability that attackers actively exploit. When every alert looks the same, none of them look important. This article examines the mechanics of alert fatigue, its quantifiable cost to organisations, and the specific practices a well-engineered managed SOC deploys to break the cycle — because the solution is not working harder, but building a fundamentally different operational model.
How SOC as a Service Supports FCA, DORA and NIS2 Compliance
The regulatory environment for cyber security has undergone a fundamental shift. The FCA's PS21/3 operational resilience framework is now fully enforceable, DORA has been in effect since January 2025, and NIS2 transposition is reshaping obligations across the EU — with the UK's own Cyber Security and Resilience Bill following close behind. For organisations navigating these overlapping requirements, a well-structured SOC as a Service engagement is no longer a convenience. It is a compliance enabler. This article maps the specific requirements of each framework to the capabilities a modern managed SOC should deliver.
What Should a Board Expect from a Modern SOC Provider?
Cyber security has moved from the server room to the boardroom. Regulators, insurers, and shareholders now expect boards to demonstrate active oversight of cyber risk — and for most organisations, that means understanding what their Security Operations Centre provider is actually delivering. This article sets out the ten areas every board should scrutinise when evaluating a modern SOC provider, from detection engineering and threat intelligence to transparent reporting, compliance alignment, and measurable outcomes.