CrazyHunter

CrazyHunter is a Go-based ransomware family, assessed by Trellix as a fork of Prince ransomware first observed in mid-2024, that targets Windows systems. Reporting indicates it has primarily targeted organizations in Taiwan, with at least six known victims, many of them hospitals and healthcare organizations. It uses a data leak site to publicize victim information and threaten publication of stolen data if ransom demands, made in cryptocurrency, are not paid.

Initial access is reported to commonly involve exploitation of weak Active Directory passwords and other AD weaknesses. For propagation, operators abuse Group Policy Objects using SharpGPOAbuse to spread rapidly across enterprise networks. For defense evasion and privilege escalation, CrazyHunter uses a bring-your-own-vulnerable-driver technique with a modified Zemana anti-malware driver, zam64.sys, to terminate legitimate security processes.

The malware uses ChaCha20 for file encryption and ECIES to protect per-file keys and nonces. It implements partial encryption using a 1:2 pattern, encrypting one byte and skipping the next two, to accelerate impact and potentially reduce detection based on sustained disk I/O. Encrypted files are typically appended with the .hunter extension. Reported operational components include ru.bat for orchestration, go.exe and go2.exe as AV-killer components, go3.exe as the primary encryptor, bb.exe as a Donut loader, crazyhunter.sys shellcode, crazyhunter.exe as a backup encryptor, and file.exe, which has been described as supporting extortion operations by acting as a file server or monitoring/deletion tool.

Known communications and infrastructure mentioned in reporting include attack-tw1337@proton.me, Telegram @Magic13377, and the Tor onion address 7i6sfmfvmqfaabjksckwrttu3nsbopl3xev2vbxbkghsivs5lqp4yeqd.onion. A wallpaper-change routine was also reported to download an image from ncmep.org. Some reporting notes Taiwanese authorities later linked the attacks to a Chinese security firm or described the actors as a Chinese hacker group, but attribution details are limited in the provided content.