Crypto24 Ransomware Group Blends Legitimate Tools with Custom Malware for Stealth Attacks

**Executive summary:** This report presents a technical analysis of the Crypto24 ransomware campaign that targets enterprise organizations across Asia, Europe, and the USA; operators use living-off-the-land tools (PSExec, AnyDesk, gpscript.exe), custom malware (Crypto24, WinMainSvc.dll keylogger, MSRuntime service), and a customized RealBlindingEDR-like tool to disable EDRs, perform credential theft, exfiltrate data (Google Drive), and ultimately encrypt files with a double-extortion scheme; the report includes IOCs, persistence/lateral movement details, remediation guidance, and hunting queries.