Ransomware Group intelligence
Suncrypt
InactiveTrack Suncrypt with 32 published victims and 2 known leak locations in a single intelligence view.
BREACH HOUSE ALERTS
Want an alert every time a new ransomware post is published?
Choose the feeds and the countries you care about — we email you when they move.
Overview
Suncrypt is tracked by Breach House as a ransomware group with 32 published victims.
United States is currently the most targeted country in this dataset.
2 known leak locations are currently associated with this group.
Leak Status Distribution
32
- Leaked 0 0.0%
- Pending 32 100.0%
- Deleted 0 0.0%
Top Countries
Interactive distribution based on the currently visible victims list.
Known Leak Locations (2)
| Label | Type | Availability | Links |
|---|---|---|---|
| Leak location 1 | Onion service | Down checked 1h ago | x2miyuiwpib2imjr5ykyjngdu7v6vprkkhjltrk4qafymtawey4qzwid.onion |
| Leak location 2 | Onion service | Down checked 1h ago | nbzzb6sa6xuura2z.onion |
Top Activity Sectors (8)
Typical Attacks (10)
▼MITRE ATT&CK does not currently catalogue Suncrypt, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v19.2. Confidence: medium. Treat it as orientation, not attribution.
-
T1059.001 PowerShell Execution
What they do: suncrypt executes malicious payloads via PowerShell scripts to stage ransomware encryption routines.
What that means: Adversaries may abuse PowerShell commands and scripts for execution.
-
What they do: suncrypt establishes persistence by injecting malicious entries into Windows Registry Run Keys.
What that means: Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key.
-
T1685 Disable or Modify Tools Defense Impairment
What they do: suncrypt disables antivirus tools and modifies security software configurations to evade detection.
What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
-
T1070.004 File Deletion Stealth
What they do: suncrypt deletes Volume Shadow Copies and backup directories via vssadmin to prevent recovery.
What that means: Adversaries may delete files left behind by the actions of their intrusion activity.
-
T1110 Brute Force Credential Access
What they do: suncrypt brute-forces local and domain account credentials using password-guessing tools for initial access.
What that means: Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained.
-
T1135 Network Share Discovery Discovery
What they do: suncrypt scans network shares using SMB tools to identify additional victims for lateral movement.
What that means: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.
-
T1021.002 SMB/Windows Admin Shares Lateral Movement
What they do: suncrypt moves laterally across networks by exploiting SMB/Windows Admin Shares to access additional systems.
What that means: Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).
-
T1567.002 Exfiltration to Cloud Storage Exfiltration
What they do: suncrypt exfiltrates victim data via encrypted C2 channels before deploying ransomware.
What that means: Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel.
-
T1486 Data Encrypted for Impact Impact
What they do: suncrypt encrypts victim files using custom ransomware binaries to maximize impact and extortion leverage.
What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
-
T1490 Inhibit System Recovery Impact
What they do: suncrypt halts system recovery processes by terminating critical services and processes post-encryption.
What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.
Crypto Wallets (1)
▼
$229,544
Received (USD)
1
Payments
1
Known wallets
$229,544
Largest single payment
2021-07-19 → 2021-07-19
Payment window
bitcoin · 1
| Address | Chain | Received (USD) | Payments |
|---|---|---|---|
bc1qpmknwh4pgvkyqq840fhx7fw36nrzu8gskx369v |
bitcoin | $229,544 | 1 |
Crowdsourced payment data from Ransomwhere, licensed CC BY 4.0. Figures are what has been reported and attributed to this family, not a confirmed total. Cite as: Cable, Jack. (2024). Ransomwhere: A Crowdsourced Ransomware Payment Dataset (1.1.0) [Data set]. Zenodo. https://doi.org/10.5281/zenodo.6512122
Ransom Notes (1)
▼The note this group leaves on a compromised machine. Click a filename to read it.
suncrypt.html
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset='utf-8'>
<meta name='viewport' content='width=device-width,initial-scale=1'>
<title></title>
<style>
html, body {
background-color: #1a1a1a;
}
body {
padding-top: 3rem !important;
}
#text h2 {
color: white;
font-size: 2rem;
font-weight: 600;
line-height: 1.125;
}
.tabs {
-webkit-overflow-scrolling: touch;
align-items: stretch;
display: flex;
font-size: 1rem;
justify-content: space-between;
overflow: hidden;
overflow-x: hidden;
overflow-x: auto;
white-space: nowrap;
}
.tabs ul {
align-items: center;
border-bottom-color: #454545;
border-bottom-style: solid;
border-bottom-width: 1px;
display: flex;
flex-grow: 1;
flex-shrink: 0;
justify-content: flex-start;
}
.tabs.is-toggle ul {
border-bottom: none;
}
.tabs li {
position: relative;
}
.tabs li {
display: block;
}
.tabs.is-toggle li.is-active a {
background-color: white;
border-color: white;
color: rgba(0, 0, 0, 0.7);
z-index: 1;
}
.tabs.is-toggle li:first-child a {
border-top-left-radius: 3px;
border-bottom-left-radius: 3px;
}
.tabs li.is-active a {
border-bottom-color: white;
color: white;
}
.tabs.is-toggle a {
border-color: #454545;
border-style: solid;
border-width: 1px;
margin-bottom: 0;
position: relative;
}
.tabs a {
align-items: center;
border-bottom-color: #454545;
border-bottom-style: solid;
border-bottom-width: 1px;
color: white;
display: flex;
justify-content: center;
margin-bottom: -1px;
padding: 0.5em 1em;
vertical-align: top;
cursor: pointer;
}
.tabs.is-toggle li:last-child a {
border-top-right-radius: 3px;
border-bottom-right-radius: 3px;
}
.container {
max-width: 1152px;
max-width: ;
flex-grow: 1;
margin: 0 auto;
position: relative;
width: auto;
}
.box {
background-color: #242424;
color: white;
display: block;
padding: 1.25rem;
border: 1px solid #303030;
}
blockquote {
background: hsl(0, 0%, 20%);
padding: 1rem;
border-left: 3px solid #55a630;
}
a {
color: #e55934;
}
</style>
<script>
let text = {
en: `<h2> Whats Happen? </h2>
We got your documents and files encrypted and you cannot access them. To make sure we�re not bluffing just check out your files. Want to recover them? Just do what we instruct you to. If you fail to follow our recommendations, you will never see your files again. During each attack, we copy valuable commercial data. If the user doesn’t pay to us, we will either send those data to rivals, or publish them. GDPR. Don’t want to pay to us, pay 10x more to the government.
<h2> What Guarantees? </h2>
We’re doing our own business and never care about what you do. All we need is to earn. Should we be unfair guys, no one would work with us. So if you drop our offer we won’t take any offense but you’ll lose all of your data and files. How much time would it take to recover losses? You only may guess.
<h2> How do I access the website? </h2>
<ul>
<li><a href="https://torproject.org" target="_blank">Get TOR browser here</a></li>
<li><a href="http://ebwexiymbsib4rmw.onion/chat.html?[snap]">Go to our website</a></li>
</ul>`,
de: `<h2> Was ist gerade passiert? </h2>
Wir haben Ihre Dokumente und Dateien verschlüsselt und Sie können nicht mehr darauf zugreifen. Jeder Angriff wird von einer Kopie der kommerziellen Informationen begleitet. Um sicherzustellen, dass wir es ernst meinen, prüfen Sie einfach Ihre Dateien und Sie werden sehen. Möchten Sie sie wiederherstellen? Halten Sie sich einfach an unsere Anweisungen, um uns zu bezahlen. Tuen Sie dies nicht, werden Sie Ihre Dateien niemals wiedersehen. Im Falle einer Zahlungsverweigerung werden die Daten entweder an Wettbewerber verkauft oder in offenen Quellen bereitgestellt. GDPR. Wenn Sie uns nicht bezahlen möchten, zahlen Sie das Zehnfache an der Regierung.
<h2> Wie sollten Sie uns trauen ? </h2>
Wir machen unsere eigenen Geschäfte und kümmern uns nicht darum was Sie tunen. Wir müssen nur verdienen. Sollten wir einfach nur bluffen, würde niemand an uns zahlen. Wenn Sie unser Angebot ablehnen, werden Sie alle Ihre Daten für immer verlieren. Wie viel Zeit werden Sie brauchen um ihre Daten selber zu ersetzen ? Sie können es sich schon denken.
<h2> Unsere Forderungen </h2>
<ul>
<li><a href="https://torproject.org" target="_blank">Holen Sie sich den TOR-Browser hier</a></li>
<li><a href="http://ebwexiymbsib4rmw.onion/chat.html?[snap]">Gehen Sie auf unsere Website</a></li>
</ul>`,
fr: `<h2> Qu'est-ce qui vient de se passer? </h2>
Nous avons crypté vos documents et fichiers et vous ne pouvez pas y accéder. Chaque attaque est accompagnée d'une copie des informations commerciales. Pour vous assurer que nous ne bluffons pas. Voulez-vous les restaurer? Faites juste ce que nous vous demandons, pour nous payer. Si vous ne suivez pas nos recommandations, vous ne verrez plus jamais vos fichiers. En cas de refus de paiement - les données seront soit revendues à des concurrents, soit diffusées dans des sources ouvertes. GDPR. Si vous ne voulez pas nous payer, payez x10 fois le gouvernement.
<h2> Qu'en est-il des garanties? </h2>
Nous faisons nos propres affaires et ne nous soucions jamais de ce que vous faites. Tout ce dont nous avons besoin est de gagner de l'argent. Si nous devions être injustes, personne ne travaillerait avec nous. Donc, si vous abandonnez notre offre, nous ne prendrons aucune infraction, mais vous perdrez toutes vos données et vos fichiers. Combien de temps faudrait-il pour récupérer les pertes? Vous pouvez seulement deviner.
<h2> Comment puis-je accéder au site web? </h2>
<ul>
<li><a href="https://torproject.org" target="_blank">Téléchargez le navigateur TOR ici</a></li>
<li><a href="http://ebwexiymbsib4rmw.onion/chat.html?[snap]">Allez sur notre site web</a></li>
</ul>`,
es: `<h2> ¿Lo que de pasar? </h2>
Ya tenemos sus documentos y archivos encriptados y usted no puede acceder a ellos. Para asegurarse de que no estamos faroleando. ¿Quiere recuperarlos? Sólo haga lo que le indicamos. Si usted no sigue nuestras recomendaciones, usted nunca verá sus archivos. Durante cada ataque, copiamos los datos comerciales valiosos. Si el usuario no nos paga, enviaremos estos datos a sus rivales o los publicaremos. GDPR. No quiere pagarnos, paga 10 veces más al gobierno.
<h2> ¿Qué pasa con las garantías? </h2>
Estamos haciendo nuestro propio negocio y nunca nos importa lo que hace usted. Todo lo que necesitamos es ganar. Hay que ser injustos chicos, nadie trabajaría con nosotros. Entonces, si deja caer nuestras propuestas, no nos ofenderemos pero usted perderá todos sus datos y archivos. ¿Cuánto tiempo se requiere para recuperar las pérdidas? Sólo usted puede adivinar.
<h2> ¿Cómo acceder al sitio web? </h2>
<ul>
<li><a href="https://torproject.org" target="_blank">Obtenga el navegador TOR aquí</a></li>
<li><a href="http://ebwexiymbsib4rmw.onion/chat.html?[snap]">Vaya a nuestro sitio web</a></li>
</ul>`,
jp: `<h2> 何があったのですか？ </h2>
ドキュメントとファイルを暗号化しました。 それらにアクセスすることはできません。 ブラフしないようにするには、 ファイルをチェックアウトして、すべてが。 それらを回復したいですか？ ただや
る
指示すること。 指示に従わない場合、ファイルは二度と表示されません。 各攻撃中に、貴重な商用データをコピーします。 ユーザーが当社に支払わない場合は、それらのデータをライバルに送信するか、公開します。
<h2> 何が保証されますか ? </h2>
私たちは私たち自身のビジネスを行っており、あなたが何をするかを気にしません。 必要なのは稼ぐことだけです。 私たちが不公平な人である場合、誰も私たちと一緒に働くことはありません。 ですから、あなたが私たちの申し出をやめても、私たちは何の罪も犯しません
すべてのデータとファイルが失われます。 損失を回復するのにどれくらい時間がかかりますか？ 推測するだけです。
<h2> Webサイトにアクセスするにはどうすればよいですか？ </h2>
<ul>
<li><a href=" https://torproject.org " target="_blank">ここで TORブラウザを入手 </a></li>
<li><a href="http://ebwexiymbsib4rmw.onion/chat.html?[snap]">当社のウェブサイトにアクセス </a></li>
</ul>`
};
function sel_lang(event) {
let active = document.getElementsByClassName('is-active')[0];
active.classList.remove('is-active');
event.target.parentElement.classList.add('is-active');
let lang = event.target.getAttribute('data-lang');
let el = document.getElementById('text');
el.innerHTML = text[lang];
}
document.addEventListener("DOMContentLoaded", ()=>{
let el = document.getElementById('text');
el.innerHTML = text['en'];
});
</script>
</head>
<body class='pt-6'>
<div class='container'>
<div class="tabs is-toggle">
<ul>
<li class="is-active"><a onclick='sel_lang(event);' data-lang='en'>EN</a></li>
<li class=""><a onclick='sel_lang(event);' data-lang='de'>DE</a></li>
<li class=""><a onclick='sel_lang(event);' data-lang='fr'>FR</a></li>
<li class=""><a onclick='sel_lang(event);' data-lang='es'>ES</a></li>
<li class=""><a onclick='sel_lang(event);' data-lang='jp'>JP</a></li>
</ul>
</div>
<div class='box'>
<div id='text'></div>
<div style='border: 1px solid red; padding: .5rem; font-size: 1.3rem; font-weight: 500; margin: 3rem 0;'>
<div class='title is-4'>
In case you decide not to cooperate, your private data will be published <a style='color: #46a049; text-decoration: underline;' target='_blank' href='http://nbzzb6sa6xuura2z.onion/'>here</a> or sold.
</div>
</div>
<div style='margin-top: 2rem;'>
<h2>Offline how-to</h2>
<p>Copy & Paste this secret message to <a href="http://ebwexiymbsib4rmw.onion">this page</a> textarea field</p>
<p><blockquote>[snip]</blockquote></p>
</div>
</div>
</div>
</body>
</html>
Ransom-note text from RansomLook, licensed CC BY 4.0.
Victims (32)
Search, filter and paginate the victim timeline for Suncrypt. Showing 1–32 of 32.
| Type | Target | Discovered | Country | Business Category | Intel Link | Leak status |
|---|---|---|---|---|---|---|
| Ransomware | SOCOTEC id3654 View details | Other | — | pending | ||
|
No additional victim description available. |
||||||
| Ransomware | Northeastern Technical College id3585 View details | Education | — | pending | ||
|
No additional victim description available. |
||||||
| Ransomware | Co-opbank Pertama id3262 View details | Finance / Legal / Insurance | — | pending | ||
|
No additional victim description available. |
||||||
| Ransomware | DJS associate id3187 View details | Other | — | pending | ||
|
No additional victim description available. |
||||||
| Ransomware | Gemeente Buren id3171 View details | Other | — | pending | ||
|
No additional victim description available. |
||||||
| Ransomware | Atlas Copco id3164 View details | Other | — | pending | ||
|
No additional victim description available. |
||||||
| Ransomware | Oklahoma City Indian Clinic id2983 View details | Healthcare / Pharma | — | pending | ||
|
No additional victim description available. |
||||||
| Ransomware | FitFlop Ltd. id2864 View details | Services | — | pending | ||
|
No additional victim description available. |
||||||
| Ransomware | Migros id2839 View details | Other | — | pending | ||
|
No additional victim description available. |
||||||
| Ransomware | Royal Smilde id2677 View details | Other | — | pending | ||
|
No additional victim description available. |
||||||
| Ransomware | CENTRAL BAPTIST COLLEGE id2676 View details | Education | — | pending | ||
|
No additional victim description available. |
||||||
| Ransomware | KVK Tech | Specialty Brands and Generics id2643 View details | IT | — | pending | ||
|
No additional victim description available. |
||||||
| Ransomware | Heartland Alliance id2590 View details | Other | — | pending | ||
|
No additional victim description available. |
||||||
| Ransomware | Community Health Center | Valle del Sol id2589 View details | Healthcare / Pharma | — | pending | ||
|
No additional victim description available. |
||||||
| Ransomware | Consumers Supply Distributing LLC id2575 View details | Services | — | pending | ||
|
No additional victim description available. |
||||||
| Ransomware | Bohlin Cywinski Jackson id2060 View details | Other | — | pending | ||
|
No additional victim description available. |
||||||
| Ransomware | Read more id2047 View details | Other | — | pending | ||
|
No additional victim description available. |
||||||
| Ransomware | Hospitality Furnishings & Design Inc. id1946 View details | Healthcare / Pharma | — | pending | ||
|
No additional victim description available. |
||||||
| Ransomware | Herman & Kittle Properties Inc. id1945 View details | Communication / Marketing | — | pending | ||
|
No additional victim description available. |
||||||
| Ransomware | Outdoor Venture Corporation (OVC) id1782 View details | Services | — | pending | ||
|
No additional victim description available. |
||||||
| Ransomware | Tri-signal Intergration id707 View details | Other | — | pending | ||
|
No additional victim description available. |
||||||
| Ransomware | Glen Dimplex Home Appliances id706 View details | Other | — | pending | ||
|
No additional victim description available. |
||||||
| Ransomware | Grushwitz id705 View details | Other | — | pending | ||
|
No additional victim description available. |
||||||
| Ransomware | Mark A. O'neal and Associates id704 View details | Other | — | pending | ||
|
No additional victim description available. |
||||||
| Ransomware | AGSO id703 View details | Other | — | pending | ||
|
No additional victim description available. |
||||||
| Ransomware | Dean and Fulkerson id702 View details | Other | — | pending | ||
|
No additional victim description available. |
||||||
| Ransomware | SB Zantal Markt id701 View details | Other | — | pending | ||
|
No additional victim description available. |
||||||
| Ransomware | JSW Steel USA id700 View details | Manufacturing / Engineering | — | pending | ||
|
No additional victim description available. |
||||||
| Ransomware | PRP diagnostic imaging id699 View details | Communication / Marketing | — | pending | ||
|
No additional victim description available. |
||||||
| Ransomware | Cornerstone Automation Systems, LLC id689 View details | Services | — | pending | ||
|
No additional victim description available. |
||||||
| Ransomware | University Hospital New Jersey id473 View details | United States | Healthcare / Pharma | — | pending | |
|
No additional victim description available. |
||||||
| Ransomware | Haywood County School District id463 View details | United States | Education | — | pending | |
|
No additional victim description available. |
||||||