Cyber Threat Actor: cryptom27

Thethreat actor known by the alias cryptom27 has been associated with a ransomware incident that occurred on November 28, 2016, against San Francisco's municipal transit system. The actor’s location is reported as China, though no further geographic details are provided. In the attack, the actor encrypted internal computer systems of the transit agency and demanded a payment of approximately 73,000 Bitcoin to restore access. During the compromise, fare‑collection systems were disrupted, allowing passengers to ride without paying. The transit agency recovered its systems without paying the ransom and returned service to normal after the disruption. This event demonstrates the actor’s focus on a transportation‑sector target and a financially motivated objective, as evidenced by the explicit ransom demand in cryptocurrency.

The observed tactics in this incident involved the deployment of ransomware that encrypted files and disrupted operational systems, with the initial access vector not disclosed in the available sources. No specific malware family, toolset, or additional tooling style is mentioned beyond the ransomware payload itself. The actor’s affiliation or any state nexus has not been established publicly; the only attribution detail available is the reported location in China. To date, the San Francisco transit ransomware attack remains the sole publicly reported operation linked to the alias cryptom27, and no other campaigns or incidents have been documented in the open‑source material provided.