CrazyHunter Ransomware Group Targets Critical Sectors in Taiwan (Campaign)

CrazyHunter is a newly observed ransomware group focusing on Taiwan’s critical sectors (healthcare, education, manufacturing). The group uses Bring Your Own Vulnerable Driver (BYOVD) techniques—notably abusing the Zemana zam64.sys driver via a tool called ZammoCide—to disable AV/EDR, leverages SharpGPOAbuse for lateral movement and privilege escalation, and deploys a heavily modified Prince ransomware (Go) alongside custom utilities (file.exe) and layered batch scripts to ensure encryption and exfiltration success.