Threat Actor Characterization
Crucio
ID: 7c315ae04cc0a2b782796bd39b7fe96e83203| Crucio Ransomware | CrucioRansomware | — | — |
Actor Network Graph
Open Network GraphMITRE ATT&CK®
Crucio is a sparsely documented ransomware label publicly associated with Soldiers of Solomon and the broader CyberAv3ngers / IRGC-linked ecosystem. Public evidence supports the name, a small set of suspected indicators, and its use inside propaganda-heavy claims targeting Israeli interests, but does not support treating it as a mature standalone criminal ransomware family.
| Technique | Technique name | Tactics | Evidence |
|---|---|---|---|
| T1486 | Data Encrypted for Impact | TA0040 |
|
| T1566 | Phishing | TA0001 |
|
| T1110 | Brute Force | TA0006 |
|
| T1078.001 | Default Accounts | TA0001 TA0003 TA0004 TA0005 |
|
Classification: TLP:WHITE | Author: iQBlack CTI Team
Executive Summary
Crucio is a purported ransomware family publicly associated with the Soldiers of Solomon persona and, by extension, with the broader CyberAv3ngers / IRGC-linked influence-and-disruption ecosystem. Public reporting around Crucio is unusually thin and should be treated with caution: the name appears mainly in October 2023 claim-posts tied to alleged compromise of Israeli servers, cameras, and smart-city management systems, and later in government or vendor reporting that explicitly notes that many of the surrounding claims were exaggerated or false.
That limitation matters analytically. Crucio should not currently be modeled as a mature, independently documented ransomware operation on the same footing as well-studied criminal RaaS families. Instead, it is better assessed as a claimed or sparsely observed ransomware component inside a broader campaign of coercive messaging, hack-and-leak theatrics, and state-aligned psychological pressure. The strongest public evidence is not a full reverse-engineering corpus, but rather a combination of government advisory references, a small set of suspected IOCs, and third-party reporting that treats Crucio as part of the Soldiers of Solomon narrative during the early Israel–Hamas conflict period.
Executive Analyst Brief for CISO — Crucio RansomwareClassification: TLP:WHITEWhat it isCrucio is a purported ransomware capability associated with the Soldiers of Solomon persona and, indirectly, with the broader CyberAv3ngers / IRGC-linked ecosystem. Public reporting confirms the name, a small set of suspected IOCs, and its use in October 2023 coercive claims against Israeli targets. Public reporting also makes clear that many of the surrounding claims were false or exa
Hunting Playbook — Crucio RansomwarePriority: MediumObjective: Detect evidence of Crucio-linked payload execution, suspected supporting infrastructure, and overlap with Soldiers of Solomon / CyberAv3ngers-style compromise patterns in server, camera-management, and OT-adjacent environments.Hunt 1 — Suspected Crucio file-hash sightingsGoal: Identify any endpoint, malware repository, sandbox, or retro-hunt match for the publicly cited suspected Crucio hashes.Scope: EDR, malware
1. Scope & Caveats
This appendix reflects the limited open-source evidence currently available for Crucio. The most reliable public artifacts come from the December 2023 joint advisory on IRGC-affiliated cyber actors and later secondary reporting that reproduced those suspected indicators. Several surrounding campaign claims were proven false or exaggerated, so these indicators should be treated primarily as hunting seeds rather than as high-confidence actor-exclusive blocklists.