Cyber Threat Actor: Crydat

Crydat operates as a ransomware threat actor with a single publicly documented operation targeting Brazil's financial sector. The group identifies itself using the Crydat alias without additional known monikers. Their sole confirmed attack occurred in October 2022 against a government-controlled financial institution, where they deployed ransomware and demanded a 50 Bitcoin ransom (approximately 5.2 million Brazilian reais) under threat of exposing customer data. The actors demonstrated a financially motivated objective through their extortion demands but did not disclose specific ideological or political motives.

The group exhibits a regional focus on Brazil based on their only verified operation, specifically targeting a high-impact financial entity with government ties. Crydat employed a pressure tactic by communicating ransom demands through a local news outlet rather than solely through private channels, amplifying reputational risks to compel payment. The tight deadline imposed on the victim suggests an operational preference for urgency in extortion schemes. Brazilian authorities, including the Federal Police's cybercrime unit, publicly acknowledged investigating the incident, though no recovery outcomes or arrest disclosures followed. The targeted organization maintained public silence regarding negotiations or compliance, leaving the attack's resolution unverified.

Crydat's operational security practices include leveraging media outlets as intermediaries for threat communication, distinguishing their approach from purely direct extortion methods. Their ransomware deployment against critical financial infrastructure indicates deliberate targeting of high-value disruption opportunities. The absence of additional claimed operations or malware signatures prevents broader analysis of their technical tooling or persistence mechanisms. Law enforcement investigations remain ongoing without public attribution to criminal consortia or state-sponsored groups, leaving the actor's organizational structure and affiliations unconfirmed. The Banco de Brasília attack stands as their defining operation to date.