cryptom27

Profile narrative

cryptom27 is the known alias used by the threat actor responsible for the ransomware attack on San Francisco’s municipal transit system in November 2016. Open‑source reporting indicates that the actor is based in China, though no further personal or organizational details have been publicly disclosed. The alias appears in connection with this single documented incident and has not been linked to other operations in available sources.

On 2016‑11‑28 the actor deployed ransomware that encrypted internal computers of the San Francisco Municipal Transportation Agency, disrupting service and preventing normal fare collection. The ransom note demanded a payment of 73 000 in Bitcoin to restore access to the affected systems. As a result of the encryption, fare gates were compromised, allowing passengers to ride without paying during the outage. The agency reported that it restored operations without paying the ransom, relying on backups and internal recovery efforts to bring services back online.

Attribution to a specific group or state sponsor remains unverified; the only publicly available geographic clue is the actor’s location in China. No statements from law enforcement or intelligence agencies have tied cryptom27 to a larger criminal consortium, nation‑state program, or ideological motive beyond the financial demand observed in the incident. Consequently, any assertion about affiliations, sponsorship, or broader strategic goals would be speculative and is omitted here.

The Muni ransomware attack stands as the sole publicly reported operation associated with cryptom27, illustrating a financially motivated ransomware campaign that targeted transportation infrastructure in the United States. This case highlights how ransomware actors can affect critical public services by encrypting operational systems and exploiting resulting service disruptions. No additional malware families, initial access vectors, or tooling details have been disclosed in the sources examined for this actor.

Incidents

Attributed incidents are available to members.

Sources

Sources available to members: 1 source.