CRPX0 — SCAMMER TURNED RANSOMWARE OPERATOR

This research article documents the emergence and operations of the CRPX0 ransomware group (active June–July 2026), detailing their dual clear-web and onion leak sites, affiliate/RAAS services, a preceding Flash Token money-laundering scam, victim listings (~47, heavy in healthcare and US/Turkey), associated infrastructure (domains, hosting ASN, Cloudflare unmasked IPs), behavioral malware analysis (dropper, EDR unhooking, Python second-stage, persistence), and IOCs (domains, TOX ID, BTC address, Telegram channels).