The Crypto24 ransomware group has added Antah HealthCare Group (AHCG), a Malaysian healthcare company, to its dark web leak site. The group claims it stole more than 500GB of data. The listing appeared on October 27, 2026, and ransomware.live estimates the attack took place a day earlier. So far the claim has not been verified. Antah HealthCare has not commented publicly, no Malaysian regulator or national CERT has issued a notice, and no established security outlet has confirmed an intrusion. Until that changes, treat this as the attacker's claim and not a confirmed breach.
What Happened
The leak site tracker ransomware.live first recorded the Antah HealthCare entry on Crypto24's onion site on October 27, 2026, with an estimated attack date of October 26. ThreatMon's threat intelligence team flagged the same claim that day, and Undercode News picked it up. Undercode stresses that the listing alone "does not confirm that Crypto24 successfully compromised" the company's systems.
The victim is described in slightly different ways. QPulse calls AHCG "a Malaysian integrated healthcare distribution partner". ThreatMon puts it in Malaysia's "healthcare and hospital sector". The difference matters: a distributor and a hospital operator hold very different data, and the actual exposure depends on which systems were hit.
Nobody has independently confirmed that systems were encrypted, that operations were disrupted, or that a ransom has been demanded or negotiated.
What Was Taken
QPulse reports, based on the group's claim, that Crypto24 says it took over 500GB of data, including:
- HR and employee records
- Customer transaction histories
- Confidential commercial contracts
- Clinical and regulatory documents
- Logistics tracking data
- Financial statements
None of this has been checked. Undercode notes that nothing verified establishes how much data was taken, or whether the group has authentic files at all. No sample data has been publicly analysed, and the claim does not say whether patient-identifiable records are part of the alleged haul.
Healthcare extortion claims are often exaggerated. In a separate case this month, South African pathology firm Ampath Laboratories confirmed it had been breached but disputed the attackers' claim of 80 million patient records. GovInfoSecurity reported that Ampath said the figure "materially overstates" the impact. AHCG's own figures, if it publishes any, may differ just as much from Crypto24's.
Why It Matters
Crypto24 is a small group, but it keeps attacking organisations in this region. Ransomware.live lists 49 victims since late 2023. Malaysia ties with Singapore for the second-highest count of any country (4 each, behind the United States with 8). The group has also hit 6 healthcare organisations. Its leak site was online and updated as recently as October 27. Ransomware.live describes it as a double-extortion ransomware-as-a-service operation that first appeared on the RAMP forum in mid-2024. Earlier victims include Vietnam's CMC Group. The tracker records 19.4TB of claimed stolen data across 23 of those 49 victims.
For AHCG's partners, the concern goes beyond the company itself. A healthcare distributor sits between manufacturers, hospitals and pharmacies. If contracts, logistics data and transaction histories have leaked, suppliers and customers could be targeted with convincing invoice fraud and phishing, even if no patient data was taken.
The Attack Technique
Nobody has confirmed how Crypto24 got in, if it did. There are two related pieces of evidence, but neither shows how the attack started:
- QPulse cites Hudson Rock data showing one AHCG employee's computer infected with infostealer malware, and a ParanoidLab exposure report listing 77 leaked passwords tied to the company's domain, 5 of them rated critical. QPulse presents these stolen credentials as the likely way in, but neither Hudson Rock nor ParanoidLab has shown they were actually used. Ransomware.live's data shows the pattern is common for this group: 50% of Crypto24 victims with a known domain had infostealer exposure.
- Trend Micro has researched how the group operates once inside. The firm says Crypto24 uses ordinary admin tools such as PsExec and AnyDesk, creates privileged accounts and scheduled tasks disguised as routine IT jobs, and installs a keylogger that uploads to Google Drive, which is also where it sends stolen data. Before encrypting files, it runs a modified version of RealBlindingEDR, which loads a vulnerable driver to switch off security software from Trend Micro, Microsoft, Symantec, Kaspersky, Fortinet and others.
Known indicators listed by ransomware.live include the contact address [email protected], the IP address 45.63.9.192:5050, and the ransom note filename Decryption.txt.
What Organizations Should Do
- Check for stolen credentials first. Look up your domains in infostealer log services. For any exposed account, reset the password and end active sessions, not just the password, and enforce phishing-resistant MFA on VPN, remote access and admin accounts.
- Watch for the vulnerable-driver trick. Turn on Microsoft's vulnerable driver blocklist, alert on new kernel drivers being loaded, and treat any security agent going offline unexpectedly as a live incident.
- Lock down remote admin tools. Allow only approved tools, flag PsExec or AnyDesk use from unexpected hosts, and audit recently created privileged accounts and scheduled tasks.
- Monitor uploads to cloud storage. Unusual volumes of data going to Google Drive or other personal cloud storage from servers or admin workstations deserve a closer look.
- Partners of AHCG should prepare now. Treat invoices, payment-detail changes and urgent document requests that appear to come from AHCG with suspicion. Confirm them by phone using contacts you already have until the company says what, if anything, was taken.
- Keep backups out of reach. Use offline or immutable backup copies that ransomware operators cannot reach with stolen domain credentials.
Sources: Crypto24 Ransomware Group Exfiltrates 500GB of Data from Antah Heal... | Pathology Lab Confirms Hack, But Disputes Data Theft Claims | Crypto24 Claims Malaysian Healthcare Group Antah HealthCare as Ever... | Oracle PeopleSoft zero-day linked to ShinyHunters arrests | Crypto24 Ransomware Recovery AS | ZeroHour — live cybersecurity & AI intelligence dashboard | Trinetra Threat Intelligence Live global ransomware map | Crypto24