Crypto24 Ransomware Recovery: Stealthy Attacks and EDR Bypass

Crypto24 was first seen in 2024 and became much more active from 2025. Trend Micro's research describes victims in Asia, Europe and the US, mostly in financial services, manufacturing, entertainment and technology. The group is notable for how quietly it works before the encryption starts.

The operators use legitimate admin tools such as PsExec and AnyDesk, create privileged accounts and scheduled tasks that look like normal IT jobs, and install a keylogger that uploads captured keystrokes to Google Drive, the same place stolen data is sent. Before encrypting, they run a modified version of RealBlindingEDR, an open-source tool that uses a vulnerable driver to switch off security products from vendors including Trend Micro, Microsoft, Symantec, Kaspersky and Fortinet.

We examine the encrypted files themselves and recover database tables, virtual machine disks, backup contents and folders from the parts that remain readable. We have solved many cases like this across SQL Server, Oracle, VMware and Veeam.

Do not delete encrypted files and do not reinstall the servers until a copy is kept. Contact us for a free assessment: we tell you exactly what is recoverable before you pay anything.