Creeper, also called Cripper, is a Windows ransomware family active from early 2018 that demands payment in Monero. Builds append one of a small set of names to each file, including .creeper, .cripper, .crypton and .rag2hdst, and leave a text note named DECRIPT_MY_FILES.txt or DECRIPT_FILES.txt. The price rises after the first couple of days and the note threatens to destroy the key soon after, though the keys sit on the attackers' server. Do not confuse .crypton with the unrelated CryptON family. Member page: Cripton.
Sources: In-house research
File extensions: .creeper, .cripper, .crypton, .rag2hdst
Ransom note filenames: DECRIPT_FILES.txt, DECRIPT_MY_FILES.txt
Decryptor: Decryptor availability has not been recorded. Checked 2026-10-30.
Dealing with an active incident? Our incident response team is available 24/7.
Emergency response: +1 (877) 364-5161