CRPX0 — SCAMMER TURNED RANSOMWARE OPERATOR

What it is

An OSINT investigation into CRPX0, a ransomware group active since early July 2026 (47 listed victims, mostly Healthcare, US-primary with Turkey unusually 2nd). The value the summary omits is the concrete infrastructure and indicators the page publishes, plus a specific defensive note on the delivery technique.

How it works

CRPX0 runs RaaS/HaaS plus an affiliate program, distributing Windows payloads as EXE and DLL. Delivery uses ClickFix — the victim is socially engineered into running a malicious command themselves (typically a pasted PowerShell command), so there is no external exploit. Each victim gets its own Session ID for contact while the TOX ID stays constant. The group also excludes CIS countries and has already shipped a "v2.0" of the tooling.

Preconditions / Affected

Windows environments where users can be induced to paste and run commands. Healthcare organizations and US/Turkey targets are over-represented. CIS-based systems are deliberately out of scope.

What to do

Block/monitor these indicators the page discloses:

• Clear-web DLS: crpx0.su (registered via REGRU-SU, a non-compliant Russian registrar also abused by INC Ransomware). Two other CRPX0 clear-web domains appear to be staging/test — no real victims listed.
• Onion DLS: tlxoddx4odmc2qvsmtsbgwwsv5j45osb5sox7mz6izxliuju5mkulzad.onion
• Negotiation onion (from the YouTube demo): kqi5yty6ipuhwz4anutty6hob6et7dvnnxg6kcnulwedjaz5oton2zyd.onion
• Recovery ID: OP_1782821901
• TOX ID: 17EB54B8455144E088C7E77F88A97221C319F0CFE4FE306853EEB113EE8DB5607BB6EE481C7C
• Primary Session ID: 050546f6719172e04151c31acb37a242fa3eeff5766aa57331d26cc06e83e9e25b (also seen on 2–3 victim pages)

For the ClickFix vector, the page's stated defense is user awareness training on the danger of running pasted PowerShell commands — since the technique relies on the user, not an external exploit, this cuts the chain at delivery.

Caveats

• The China attribution is weak by the author's own account: it rests only on a Mandarin test machine in the YouTube walkthrough and a non-native-English (non-AI) narrator voice — explicitly "not a strong indicator."
• Two of the three clear-web domains are assessed as staging/test servers (no real victims), so only crpx0.su and the first onion are confirmed live DLS.
• Leak "proof" samples are KB-sized against claimed GB-scale data, consistent with a sale model rather than full dumps.
• Full IOC list and MITRE ATT&CK mapping are in sections not included in the fetched text; the samples are described as not yet publicly released elsewhere.