CRPxO Ransomware Claims Attacks on Qube Aviation, ProSmile
CRPxO Ransomware Group Hits Aviation and Healthcare Targets
Related Entities
Threat Actors
Other
Full Report
Executive Summary
On July 27, 2026, the CRPxO ransomware group publicly claimed responsibility for multiple cyberattacks targeting U.S. organizations in the aviation and healthcare sectors. The group's leak site was updated to include Qube Aviation Catering, from which they claim to have exfiltrated 22.5 GB of data, and ProSmile Family Dental Care, with an alleged 9.6 GB of data stolen. Additionally, the group was linked to a breach at American Home Healthcare. These incidents highlight the ongoing threat from the CRPxO group, which employs a double extortion strategy of encrypting data and threatening to leak it. The attacks underscore the vulnerability of small to mid-sized organizations in critical sectors that handle sensitive operational and personal data.
Threat Overview
CRPxO is a ransomware operator that follows the common RaaS (Ransomware-as-a-Service) model. The group's primary TTP is double extortion: they gain access to a victim's network, exfiltrate large quantities of sensitive data, and then deploy their ransomware to encrypt systems. The stolen data is used as leverage, with the threat of public release if the ransom is not paid. The targeting of Qube Aviation Catering suggests an interest in the supply chains of critical infrastructure, while the attacks on ProSmile Family Dental Care and American Home Healthcare show a continued focus on the healthcare sector, which is rich in valuable personally identifiable information (PII) and protected health information (PHI).
Technical Analysis
While the specific initial access vectors for these attacks were not disclosed, ransomware groups like CRPxO typically use a standard set of TTPs:
- Initial Access: Often gained through phishing emails with malicious attachments (T1566.001), exploitation of unpatched vulnerabilities in public-facing services like VPNs or RDP (T1190), or purchasing stolen credentials from initial access brokers.
- Execution and Persistence: After gaining a foothold, they deploy common post-exploitation frameworks like Cobalt Strike to maintain access and escalate privileges.
- Data Exfiltration: Before encryption, the attackers collect and compress sensitive data from file servers and databases (T1560.001). The data is then exfiltrated to cloud storage or actor-controlled servers, as seen with the 22.5 GB and 9.6 GB claims.
- Impact: The CRPxO ransomware payload is executed across the network, encrypting files (T1486) and leaving a ransom note with instructions for payment.
Impact Assessment
For the victims, the impact is multi-faceted. Qube Aviation Catering faces potential disruption to its services, which could affect airline operations. The exfiltrated 22.5 GB of data could contain sensitive client contracts, operational plans, and employee information. For ProSmile Family Dental Care and American Home Healthcare, the theft of patient data (9.6 GB from ProSmile) constitutes a significant data breach under HIPAA, leading to regulatory fines, patient lawsuits, and severe reputational damage. All victims face the immediate cost of business interruption, incident response, and system restoration, in addition to the pressure of the extortion demand.
IOCs — Directly from Articles
No specific Indicators of Compromise (IOCs) have been published in the source articles.
Cyber Observables — Hunting Hints
Security teams can hunt for generic ransomware precursor activity:
vssadmin.exe delete shadows /all /quietrclone.exeDetection & Response
- Endpoint Detection and Response (EDR): Deploy an EDR solution to detect and block common ransomware behaviors, such as disabling security tools, deleting shadow copies, and mass file encryption. Utilize Process Analysis to identify suspicious command-line arguments.
- Network Egress Monitoring: Monitor outbound network traffic for large data transfers to unexpected destinations. Blocking unauthorized cloud storage services can help prevent data exfiltration.
- Decoy Files: Place decoy files (honeypots) on file servers. Monitor these files for any modification activity; since no legitimate process should touch them, any access is a strong indicator of a breach. This is a form of Decoy Object.
- Active Directory Security: Monitor for signs of Active Directory compromise, such as the creation of new high-privilege accounts or changes to group policies.
Mitigation
- Immutable Backups: Maintain regularly tested, offline, and immutable backups of all critical data. This is the most important defense against ransomware, as it ensures you can restore operations without paying the ransom.
- Patch Management (M1051): Aggressively patch all internet-facing systems and software to close the vulnerabilities that ransomware groups commonly exploit.
- User Training (M1017): Train employees to recognize and report phishing emails, which remain a primary initial access vector.
- Network Segmentation (M1030): Segment the network to prevent ransomware from spreading from a compromised workstation to critical servers and backups.
Timeline of Events
MITRE ATT&CK Mitigations
Update Software
Keep all systems, especially internet-facing ones, patched to prevent initial access via vulnerability exploitation.
Mapped D3FEND Techniques:
Network Segmentation
Segment your network to limit the lateral spread of ransomware.
Mapped D3FEND Techniques:
User Training
Conduct regular security awareness training to help users identify and report phishing attempts.
Antivirus/Antimalware
Use a modern EDR solution that uses behavioral analysis to detect and block ransomware activity.
Mapped D3FEND Techniques:
D3FEND Defensive Countermeasures
To detect a ransomware actor like CRPxO during the reconnaissance and collection phase, organizations can strategically place Decoy Objects, or honeypots, on their network. Create fake files with enticing names like passwords.xlsx, 2026_financials.docx, or client_list.csv and place them on production file servers. These files should have no legitimate business use. Configure high-priority alerts using a File Integrity Monitoring (FIM) tool to trigger the moment any of these decoy files are read, modified, or copied. Since no legitimate user or process should ever access these files, any alert is a high-fidelity indicator of an intruder on the network. This provides an early warning that an attack is in progress, allowing security teams to respond before the attacker can exfiltrate real data or deploy the encryption payload.
Modern EDR solutions with advanced Process Analysis capabilities are essential for stopping ransomware attacks. Configure EDR policies to specifically monitor for chains of behavior common to ransomware. For example, a rule could detect a process (e.g., powershell.exe) that first disables a security service, then executes vssadmin.exe delete shadows, and finally begins rapidly enumerating and writing to a large number of files. This sequence is highly indicative of a ransomware attack. By analyzing the parent-child process relationships and command-line arguments, the EDR can identify and terminate the malicious process chain before widespread encryption occurs. This behavioral approach is far more effective than relying on static file signatures, which ransomware authors can easily change.
Timeline of Events
CRPxO ransomware group claims attacks on Qube Aviation Catering and ProSmile Family Dental Care on its leak site.
CRPxO is linked to a breach at American Home Healthcare.
Sources & References
Article Author
Jason Gomes
• Cybersecurity PractitionerCybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
Editorial Standards & Analyst Review
CyberNetSec.io uses automation to assist source monitoring, deduplication, observable extraction, and structured intelligence generation. Published analysis follows human-defined editorial standards and adds defensive context including MITRE ATT&CK, D3FEND, STIX, and Sigma where applicable. Read our editorial policy.
Tags
📢 Share This Article
Help others stay informed about cybersecurity threats
🎯 MITRE ATT&CK Mapped
Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.
🧠 Enriched & Analyzed
Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.
🛡️ Actionable Guidance
Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.
🔗 STIX Visualizer
Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.
⚡ Sigma Generator
Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.