RedCryptoApp ransomware

RedCryptoApp (also called Red CryptoApp or Red ransomware) is a double-extortion operation first seen in early 2024. Encrypted files take the suffix .REDCryptoApp, and a note called HOW_TO_RESTORE_FILES.REDCryptoApp.txt is left behind. The note opens with "Attention!", says the network was breached and data downloaded, and sends the victim to a per-victim Tor login with a long hash ID to negotiate. Victims are businesses in the US, Europe and Asia, with software and manufacturing hit most. The group publishes stolen archives on a leak site it calls a "Wall of Shame" and has asked for ransoms in the millions of dollars. How it gets in has not been documented publicly, and no tie to an earlier family has been confirmed.

File extensions: .REDCryptoApp

Ransom note filenames: HOW_TO_RESTORE_FILES.REDCryptoApp.txt

Decryptor: Decryptor availability has not been recorded. Checked 2026-10-28.

Data exfiltration risk: Likely — The note says data was downloaded and the group has published victim archives on its leak site.

Systems typically targeted: Windows business networks

Do this first: Keep the HOW_TO_RESTORE_FILES.REDCryptoApp.txt note and its hash ID unchanged, since it is the only key to the per-victim negotiation portal.