CRPxO Ransomware: Attack Chain, IOCs, and MITRE ATT&CK TTPs

CRPxO is a financially motivated extortion operation that emerged under this name in mid-2026, combining ransomware, cryptocurrency theft, and data-leak extortion. Beyond encryption, the same brand operates an affiliate program and cryptocurrency clipper, sells a payload builder, and markets paid access to stolen data.

This article is a standalone reference for incident response teams, MSPs, and security decision-makers. If you suspect CRPxO activity in your environment, engaging a professional incident response team early helps preserve the evidence needed to scope the incident.

CRPxO ransomware at a glance

What is CRPxO ransomware?

CRPxO (also stylized CRPx0 and tracked as DataBreach+ or DataBreachPlus) combines file encryption, cryptocurrency theft, and an advertised paid-access offering for stolen data. Analyzed samples use a staged Python runtime, clipboard hijacking, seed-phrase harvesting, and Fernet-based encryption that appends the .crpx0 extension.

By contrast, claims about builder history and perimeter exploitation largely come from the operator's advertising and remain unverified. Available infrastructure links point with moderate-to-high confidence to a former crypto-scam operator rather than an established crew; documented delivery relies on social engineering.

How the CRPxO affiliate and white-label model works

CRPxO is marketed and technically structured as ransomware-as-a-service, with a payload builder and white-label option, but the number and independence of its affiliates remain unverified; a single operator may control the core operation.

The operators advertise lifetime affiliate access for a one-time $333 fee and a flat 70:30 revenue split in the affiliate's favor. On August 23, they published a v3.0 control-panel announcement on their clear-web site; the newly claimed capabilities were not verified in the recovered samples.

Who CRPxO targets

CRPxO is opportunistic and cross-sector, centered on small and mid-sized US organizations. In an August 2026 count of 47 unverified leak-site claims, healthcare was the most represented named sector, followed by financial services and technology.

A second cluster of leak-site claims involves organizations in Türkiye, including a batch of prominent names posted on August 1. Near-synchronous countdowns and limited proof may indicate inflated claims or externally sourced datasets; neither explanation is confirmed.

Disclaimer: Victim listings on ransomware leak sites represent unverified claims made by the threat actor. Treat them as unconfirmed unless corroborated by company disclosures, SEC filings, regulatory notifications, or law enforcement confirmation.

CRPxO attack lifecycle

The analysis covers three CRPxO variants: an OnlyFans-themed lure build, an affiliate-generated build, and a ClickFix build. All three converge on a staged Python execution framework, although their behavior differs. The ClickFix findings below are based on static analysis of recovered code; the samples were not executed.

Phase 1: Initial access

One analyzed CRPxO lure is a ZIP archive named to suggest that it contains credentials for "working" accounts on OnlyFans, a subscription platform widely associated with paid adult content. In reality, the archive contains a disguised shortcut (.lnk). Opening the shortcut launches cmd.exe with obfuscated commands that fetch a script loader from attacker infrastructure. Available reporting does not establish whether this lure was used against any of the organizations CRPxO lists as victims.

The second path is ClickFix: a fake CAPTCHA or update prompt tells the user to run PowerShell through the Windows Run dialog or a curl-to-shell command in macOS Terminal. Victim execution can bypass controls focused on malicious attachments and conventional downloads. The behavior maps to MITRE ATT&CK T1204.004, User Execution: Malicious Copy and Paste.

Phase 2: Execution and environment setup

In the OnlyFans-lure build, a VBScript loader prepares the host and downloads a portable Python interpreter directly from the official Python distribution, then installs the libraries the payload needs. Staging a legitimate runtime this way lets the malware avoid shipping a custom unpacker and blend into normal developer-tool activity.

In builder-generated affiliate builds, the executable stager drops a disguised DLL into the local application-data directory, executes it, and unpacks the Python runtime using the legitimate Windows tar.exe as a living-off-the-land tool.

On Windows, the ClickFix code attempts to bypass UAC through fodhelper.exe when it is not already elevated.

Phase 3: Persistence

Windows persistence varies by build: a WindowsHealthMonitor Run key and System32.vbs Startup entry (OnlyFans); a CryptoGuard Run key and CryptoUpdate task (builder); or an ONLOGON task named "OneDrive Sync Maintenance" (ClickFix). The lure-campaign build also deletes StartupApproved registry entries, re-enabling disabled startup items.

On macOS, persistence uses a LaunchAgent plist under ~/Library/LaunchAgents/. Documented names include com.cryptoprice.guard.plist and com.sys32.data.plist; ClickFix code uses com.apple.sync.plist.

Phase 4: Defense evasion

The ClickFix code invokes an ntdll.dll-unhooking routine, while the builder exposes the same technique as a configurable capability. By restoring clean function bytes, the technique strips user-mode hooks used by endpoint tools without loading a driver.

The payload also checks an embedded expiration date and exits if that date has passed, frustrating delayed sandbox analysis. It also terminates multiple security services before proceeding.

Phase 5: Cryptocurrency theft and collection

In the OnlyFans-lure build, CRPxO monitors the clipboard for wallet addresses associated with eight cryptocurrencies: Bitcoin, Ethereum, Tron, Dogecoin, Litecoin, Solana, XRP, and Bitcoin Cash. It replaces matches with attacker-controlled addresses supplied by the C2 and reports both the original and replacement addresses back to the server.

The operator can also issue a seed_scanner command that walks the file system for documents, logs, and configuration files, applies a BIP39 wordlist to identify wallet recovery phrases, and exfiltrates matches with surrounding context. A valid recovered seed phrase can enable the operators to take control of the associated wallet.

Phase 6: Data exfiltration and encryption

Before encryption, the payload inventories drives and user directories and reports the scan to the C2 alongside host details. In the ClickFix build, it then archives and exfiltrates a selected sample of office documents and high-value credential files.

Execution varies by build: the OnlyFans-lure build starts encryption in response to a C2 command, while the ClickFix code encrypts after exfiltration. The analyzed affiliate EXE attempts to delete the Windows Backup Catalog and volume shadow copies. This behavior maps to Inhibit System Recovery (T1490).

The module generates a per-victim Fernet key (AES-128-CBC) and encrypts documents, media, databases, archives, email stores, and source code, appending .crpx0. Older builds send that key to the C2; the ClickFix build attempts to register it with the C2 and embeds an RSA-4096-OAEP-wrapped copy in each encrypted file, encrypting only the first 1 MB. The payloads skip core OS directories so the host remains bootable and the ransom instructions remain accessible.

The ClickFix code also contains lateral-movement routines that attempt to encrypt reachable SMB shares, copy the payload to Windows hosts over administrative shares, and execute it through WMI or a remote scheduled task named "OneDrive Maintenance"; its macOS and Linux branches include code for SSH-based propagation.

Extortion model and leak site

CRPxO's paired Tor and clear-web leak sites appeared on August 7. At publication, they advertised a $500 one-time "all-access" pass to claimed victim data and separately listed data attributed to individual victims for sale after their deadlines expired. Negotiations use Session and Tox; the Tox ID matches one seen in the operator's earlier scam activity, which is part of the basis for the public attribution. The operation reportedly prefers Monero (XMR), although the analyzed ClickFix note also accepts BTC.

After encryption, the analyzed OnlyFans-lure and ClickFix builds set a wallpaper reading "CRPx0 hit you," direct victims to HOW TO RECOVER.txt, and assign a negotiation ID. The ransom-note format and deadline vary by build.

DO NOT PAY THE RANSOM. Promises to delete stolen data after payment cannot be verified and should carry little weight. Any decision about ransomware payment carries legal, operational, and financial consequences and should be assessed with qualified legal counsel and an incident response team before engaging the threat actor or making a payment.

Indicators of compromise

The indicators below are drawn from public malware analysis of the lure campaign, affiliate builds, and the ClickFix build. File names, paths, and hashes vary by build; treat them as hunting leads and verify them against current threat-intelligence feeds before deployment.

Files, paths, and encryption artifacts

Network

File hashes (SHA-256)

ClickFix build (behavioral indicators)

MITRE ATT&CK mapping

The mapping below aligns CRPxO behavior documented in analyzed code and disassembly to ATT&CK techniques; it reflects code presence, not runtime-confirmed activity.

For T1055, the analyzed code contains an injection function, but its invocation point was not established.

Detection and threat hunting

CRPxO’s reliance on legitimate tooling limits signature-based coverage, so behavioral detection matters more. The observables below are high-signal starting points for hunting.

• A newly staged portable Python runtime: python.exe or pythonw.exe in a recently created %APPDATA% or temp folder, especially when extracted by tar.exe or launched by a suspicious parent. Legitimate per-user Python installs usually reside under %LOCALAPPDATA%\Programs\Python.
• A scheduled task with an ONLOGON trigger, or a Run/Startup entry that relaunches the payload: especially entries named to look like health, update, or sync services (e.g., WindowsHealthMonitor, CryptoUpdate, "OneDrive Sync Maintenance") that point to a script interpreter.
• Clipboard-substitution anomalies: a cryptocurrency address that changes between copy and paste is characteristic of clipper malware. Where available, telemetry showing anomalous clipboard access can help detect this behavior.
• ntdll.dll memory-protection changes: a process that makes ntdll.dll code pages writable and replaces hooked function bytes with unmodified copies can indicate unhooking, particularly if the process does not normally modify ntdll.dll. Establish a baseline for legitimate security and debugging tools, and ensure that tamper detection is enabled.
• A ClickFix pattern: explorer.exe launching PowerShell or another interpreter through the Windows Run dialog, or a shell launched from macOS Terminal, with an encoded or download-and-execute one-liner shortly after a lure page is viewed.

Several CRPxO capabilities overlap with a broader pre-encryption pattern seen in ransomware incidents. As Proven Data's Head of DFIR, Magdy Abdelaziz, explains: “Usually the pre-encryption sequence: security tools being disabled, shadow copies being deleted, backup consoles being accessed, remote execution spreading across systems, and payloads being staged on admin shares. When those events cluster within minutes, we treat it as ransomware deployment in progress, not isolated suspicious activity.”

What to do if CRPxO is active in your environment

The sequence below prioritizes actions that most affect whether recovery takes days or weeks.

1. Isolate deliberately, not destructively. Isolate affected systems from the network (at the switch level if multiple hosts are involved) and terminate compromised VPN sessions. Avoid powering hosts off unless disconnection is impossible; shutdown destroys volatile evidence. Isolate or segment domain controllers and backup systems when evidence shows exposure or the incident-response plan calls for it.
2. Preserve ransomware evidence before remediation. Capture memory and disk artifacts from affected hosts and the leak-site listing itself. Reimaging affected hosts before evidence capture can destroy local telemetry needed to scope the incident and verify eradication.
3. Hunt every persistence mechanism. CRPxO establishes footholds through Run keys, Startup scripts, and scheduled tasks on Windows, and through LaunchAgents on macOS. Missing one can lead to reinfection after systems are restored.
4. Rotate credentials and secure wallets. Because the malware harvests seed phrases and scans files for credentials, treat wallets with exposed seed phrases and accounts with exposed credentials or active sessions on the affected host as compromised. Move exposed funds to wallets generated from new, uncompromised seed phrases.
5. Sequence recovery around trust, not just data. Restore identity and backup infrastructure from known-clean media before workloads. A successful restore into an environment that still trusts a compromised account is not a recovery.
6. Assess regulatory exposure early. For HIPAA-covered entities and business associates, confirmed or suspected compromise of unsecured PHI requires prompt legal and regulatory assessment; separate state notification duties may apply. Involve counsel as soon as data theft is suspected.

For organizations without in-house DFIR capacity, professional ransomware recovery services allow containment, forensic scoping, and restoration to proceed in parallel rather than sequentially.

Can files encrypted by CRPxO be recovered?

No public decryptor is known as of publication, and without a valid victim key, brute-force recovery is not practical.

Three recovery paths are realistic: restoring from unaffected backups, which is why backup isolation is critical; recovering unencrypted or earlier copies from snapshots and replicas; and professional forensic reconstruction from artifacts left behind, although success is not guaranteed. In the analyzed ClickFix build, unencrypted data beyond the first 1 MB may help reconstruct some file formats.

One analyzed build contains a decryption routine, but it still requires the victim key and is not evidence that payment will produce a working decryptor.

Security checklist

• Train users to recognize ClickFix prompts and block script execution through the Windows Run dialog.
• Use application control to restrict script interpreters and alert when Python runs from user-writable directories.
• Enable EDR tamper protection and alert on ntdll.dll unhooking.
• Enforce phishing-resistant MFA, disable legacy authentication, and revoke active sessions after compromise.
• Protect backups from ransomware by isolating backup infrastructure and using credentials that do not authenticate against the primary domain.
• Monitor egress to unfamiliar hosts and known CRPxO C2 domains.