Blackbyte-Crux

Parsing : Enabled

Description

Crux is a newly identified ransomware variant active since July 2025, which claims affiliation with the established BlackByte ransomware group. It implements a double‑extortion model—encrypting files (with the .crux extension) and threatening data leak via a Tor-based portal. A distinctive feature of Crux is its execution flow: it initiates via svchost.exe, cmd.exe, and bcdedit.exe to disable Windows recovery, followed by rapid file encryption. The ransomware has been confirmed in at least three incidents across sectors including agriculture, education, professional services, media, and nonprofits, in both the U.S. and U.K. Ransom notes consistently follow the naming pattern crux_readme_[random].txt.

External Analysis
https://www.huntress.com/blog/crux-ransomware
https://www.itpro.com/business/cybersecurity-researchers-have-spotted-a-potent-new-ransomware-strain-being-used-in-the-wild
https://securityboulevard.com/2025/07/new-crux-ransomware-emerges-in-three-attacks-this-month/
https://www.watchguard.com/wgrd-security-hub/ransomware-tracker/blackbyte-crux

Mail
BlackBCruxSupport@onionmail.org

Other
https://www.huntress.com/blog/crux-ransomware

Urls	Screen
http://dounczge5jhw4iztnnpzp54kd4ot3tikhjsimurtcewqssgye6vvrhqd.onion/	Screen

File servers	Screen
http://faow6n2hkweyyalp67zvonafn2dzphw36cav653wamj724mwsmtfa5yd.onion/	Screen

Chat servers	Screen

Admin servers	Screen

Posts

Date	Title	Description
2025-07-30	Towne Mortgage	Founded in 1982, The Towne Mortgage Family of Companies has more than 40 years of experience in the mortgage industry. Passionate about our customers, our company and the communities we serve, Towne is actively involved with many non-profit organizations. Our community outreach initiatives are not just a side-effect of our business; they are the heart of it. We are, first and foremost, a local lender. Our commitment extends beyond outreach to the products we offer, including a program specifically designed to aid in the rehabilitation of struggling neighborhoods. So while we have experienced aggressive growth in the past 3 years, we continue to focus on areas often underserved by large, corporate lenders.
2025-07-30	Cpat Flex	CPAT FLEX provides innovative ingress and leakage detection solutions specifically designed for Hybrid Fiber-Coaxial (HFC) networks. Their product lineup includes a range of advanced tools that enhance network performance, ensure reliability, and simplify maintenance for network operators. Targeting cable network providers, they offer solutions for both ingress noise management and cable leakage detection, ensuring compliance with industry regulations. CPAT FLEX emphasizes creativity and collaboration to help clients improve service quality and reduce operational disruptions.
2025-07-29	DARA Pharma	Dara Pharmaceutical designs, develops, and manufactures packaging equipment for washing, sterilizing, filling, freeze-drying, and closing machines for vials, bottles, syringes, cartridges, and IV Bags to process liquid, semi-solid products, and powders in sterile conditions.
2025-07-29	Lee & Associates	In 1979, Bill Lees vision became reality when he opened the first office of Lee & Associates in Orange County, California. Every Lee office is owned and operated by the real estate professionals, all of whom benefit from the sharing of real-time market intelligence that is vital to the delivery of superior commercial real estate services. The unique service platform has attracted some of the most experienced and talented real estate professionals in the industry, all of whom share Bills original vision of superior service through teamwork. Our offices offer a broad array of real estate services tailored to meet the needs of the companys clients in each of the markets it serves. They include commercial real estate brokerage, property management, valuation, asset management and finance. Now the largest firm of its kind in North America, the companys reach extends across the United States and Canada.
2025-07-18	GreenLight Biosciences	Founded in 2008, GreenLight Bioscience is a pre-commercial stage synthetic biology company with a proprietary cell-free ribonucleic acid (RNA) production platform for the discovery, development and commercialization of high-performing products. The company is based in Medford, Massachusetts.
2025-07-18	T2 Group	We are people that value the journey towards excellence, actively seeking individuals who share this commitment — both within our team and among our clients. In collaboration, we operate as a unified force, sharing the ambition to achieve remarkable results that outshine the competition, redefine industries, and make meaningful impact.
2025-07-18	Ark Consultancy	ARK Consultancy Limited is a leading management and technical consultancy specializing in social housing, dedicated to supporting local authorities and housing associations throughout the UK. They offer a wide range of services that include asset management, decarbonization, resident engagement, and strategic governance.
2025-07-18	Allstarmg	Founded in 1999, Allstar Marketing Group is a Performance Marketing company that has been directly responsible for some of the most successful consumer products in history. Allstar works with brands who are on the precipice of becoming a household name, but are unable to market and distribute to retail at a larger scale.
2025-07-18	Helpsonv	HELP of Southern Nevada provides assistance to families and individuals in overcoming barriers to self-sufficiency through various direct services, training, and referrals to community resources. Their offerings include adult and family housing programs, behavioral health services, and a diaper bank, among others.