crypto24 ransomware group lists CMC Corperation on its leak site

• Ransomware group: crypto24
• Country: Vietnam
• Sector: Technology
• Announcement date: April 12, 2025

Crypto24 claims data breach at CMC Corporation

The threat actor known as crypto24 has announced a significant data breach involving CMC Corporation, a prominent technology firm based in Vietnam. According to an announcement made on April 12, 2025, the group claims to have successfully compromised the organization's digital infrastructure and exfiltrated a substantial volume of data.

In the context of modern cyber warfare, ransomware groups often utilize a tactic known as double extortion. This method involves not only encrypting an organization's systems to disrupt operations but also stealing sensitive information to use as leverage. By threatening to leak stolen data on public leak sites, these actors aim to pressure victims into paying ransoms to prevent the exposure of proprietary or customer information. While the specific ransom demand in this instance has not been disclosed, the claim of a large-scale data theft is a hallmark of this extortion strategy.

Details of the alleged data theft

The crypto24 group claims to have obtained approximately 2 TB of data, which they allege was taken directly from the organization's data center. The group asserts that the compromised information is deeply integrated into the institution's digital infrastructure. While the group has not provided any screenshots to verify their claims, they have specified the types of information they allegedly possess.

The stolen information is said to include data retrieved from various database management systems, such as MariaDB, MongoDB, and RARS-DB. The specific categories of data mentioned in the announcement include:

• Token data
• Database records
• Website data

The presence of such diverse data types—ranging from authentication tokens to entire database records—suggests a broad reach into the target's digital environment. Such breaches often highlight vulnerabilities in how databases are secured or how access controls are managed within a corporate network.

About CMC Corporation

CMC Corporation is a leading technology company headquartered in Vietnam. The organization operates as a major player in the regional IT sector, providing a wide range of specialized services. Their business portfolio includes software development, system integration, cloud computing, and cybersecurity services. Given their role in providing critical IT infrastructure and security solutions, the integrity of their own data is paramount to their operational mission.

Implications and organizational risks

This incident suggests that the organization's digital assets and customer data may be at risk of exposure. The nature of the allegedly leaked data could impact the organization's operational continuity and user security. If the data is published, secondary risks such as identity theft or targeted phishing attacks may emerge for the organization's customers. Furthermore, the breach could trigger legal processes regarding the organization's data security policies and its compliance with established industry standards.

For organizations operating within the technology sector, incidents of this nature underscore the necessity of robust defensive postures. Common defensive steps include implementing strict principle of least privilege (PoLP) access controls, ensuring comprehensive encryption for data at rest and in transit, and maintaining rigorous monitoring of database access logs. Additionally, regular vulnerability assessments and patch management are essential to mitigate the risks posed by known exploits. As information regarding the crypto24 group remains limited in the public domain, organizations must remain vigilant against evolving tactics used by such actors.