CrazyHunter: The “Ruthless” Ransomware Stalking Healthcare

A new, highly aggressive ransomware named CrazyHunter is stalking the healthcare sector, with Trellix researchers releasing an in-depth analysis of its methods and objectives. First appearing in mid-2024 as a fork of the Prince ransomware, it has rapidly evolved into a significant and concerning threat, with Taiwan identified as its primary hunting ground and six organisations in that region compromised, including multiple hospitals.

The malware dismantles enterprise defences by exploiting weak passwords in Active Directory and weaponising Group Policy Objects through SharpGPOAbuse to spread rapidly across networks, while a Bring-Your-Own-Vulnerable-Driver technique uses a modified anti-malware driver (zam64.sys) to terminate legitimate antivirus processes.

It encrypts data with a ChaCha20 stream cipher using a partial encryption approach—one byte encrypted, then two skipped—allowing a larger number of files to be affected quickly and potentially evading some security monitoring. The threat actors publish a data leak site with a Strategic Manifesto and offer Premium Criminal Branding Services, threatening to publish victim data if a ransom isn’t paid, with cryptocurrency as the demanded payment method.

The healthcare focus is described as deliberate due to the critical nature of patient data and the severe consequences downtime can cause, according to Trellix.