# CryptoRex breaches Arkin Hotel Group, casino data

Published: 2026-07-14 · Severity: medium · Sectors: retail
Canonical: https://vorant.io/reports/4c6d3b0f-6f70-5e56-9449-9284c913abd7/cryptorex-breaches-arkin-hotel-group-casino-data

> Attackers linked to CryptoRex exfiltrated 1.4TB of guest and casino data from Arkin Hotel Group's Northern Cyprus properties, now being auctioned online.

Arkin Group, a hotel and casino operator in Northern Cyprus, suffered a significant data breach affecting its Colony, Iskele, and Palm Beach properties, including the Palm Beach Casino. Attackers reportedly gained initial access via a compromised reservations-department employee account, then used legitimate remote administration tools to escalate privileges and move laterally past network segmentation before exfiltrating approximately 1.4TB of data. The stolen dataset includes full guest profiles with passport scans, payment and booking details, internal CRM notes on VIP clients, and casino-specific records such as player IDs, deposit histories, and KYC/AML source-of-funds documentation for high rollers.

Analysts attribute the intrusion to a group tracked as "CryptoRex," active since 2023 and reportedly specializing in hospitality and gambling targets in the Mediterranean region; attribution confidence should be treated as low given the lack of independent corroboration. No formal ransom demand has been confirmed, but portions of the stolen archive have appeared on underground forums with an auction starting at 8 BTC, suggesting a dual monetization strategy of extortion and direct data sale.

The exposure of casino AML/KYC records and VIP guest data creates elevated downstream risk: targeted fraud, blackmail, and physical-security threats against wealthy patrons, alongside potential regulatory and financial-network scrutiny (e.g., card network reviews) despite the jurisdiction's ambiguous regulatory coverage. The company has not issued an official statement; booking systems are degraded and local authorities say they are coordinating with EU cyber-resilience contacts.

## Mentioned in this report

- Threat actors: CryptoRex

## Detection guidance (public sample)

### Remote Administration Tool Launched from User-Writable Directory

ATT&CK: T1219

Detects execution of common legitimate remote access/RMM tool binaries from temp, downloads, or user profile paths rather than their standard installation directories - a pattern seen when intruders bring their own portable copy to blend in with legitimate admin traffic for lateral movement. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Remote Administration Tool Launched from User-Writable Directory
description: Detects known remote access/RMM tool executables (AnyDesk, TeamViewer,
  ScreenConnect, RustDesk, etc.) running from temp/downloads/user-profile paths instead
  of their standard Program Files install location. Attackers who abuse legitimate
  RMM software for privilege escalation and lateral movement often stage a portable
  copy outside the normal install path.
tags:
- attack.command_and_control
- attack.t1219
logsource:
  category: process_creation
  product: windows
detection:
  selection_tools:
    Image|endswith:
    - \AnyDesk.exe
    - \TeamViewer.exe
    - \ScreenConnect.ClientService.exe
    - \ScreenConnect.WindowsClient.exe
    - \RustDesk.exe
    - \ConnectWiseControl.Client.exe
    - \AA_v3.exe
    - \Splashtop-streamer.exe
  selection_paths:
    Image|contains:
    - \Users\
    - \AppData\
    - \Temp\
    - \Downloads\
  filter_legit_install:
    Image|contains:
    - \Program Files\
    - \Program Files (x86)\
  condition: selection_tools and selection_paths and not filter_legit_install
falsepositives:
- IT staff running portable RMM builds from a personal profile for one-off support
  sessions
- Software packaging/deployment tools that stage RMM installers in user directories
  before installation
level: medium
id: 6454cec2-282a-5be7-8324-5eb16c3ffde1
status: experimental
author: Vorant
```

### Upload to Public File-Sharing or Cloud Storage Service Following Internal Access

ATT&CK: T1567

Detects outbound web traffic to well-known public file-sharing/cloud-storage upload endpoints, a common channel for bulk exfiltration of stolen data once an intruder has staged it internally; intended to be correlated with prior lateral movement or large internal transfer alerts rather than fired in isolation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Upload to Public File-Sharing or Cloud Storage Service Following Internal Access
description: Detects HTTP/S requests to public file-sharing or cloud-storage upload
  endpoints that are commonly abused as a low-friction exfiltration channel for large
  stolen datasets. This generalises on the behaviour of using a legitimate web service
  for outbound transfer rather than any specific domain used in a single campaign;
  analysts should scope the destination list to services not sanctioned for business
  use in their environment and correlate volume/timing with other lateral-movement
  indicators.
tags:
- attack.exfiltration
- attack.t1567
logsource:
  category: proxy
  product: windows
detection:
  selection:
    c-uri|contains:
    - /upload
    - /api/upload
    - transfer.php
  selection_method:
    cs-method:
    - POST
    - PUT
  selection_services:
    DestinationHostname|contains:
    - mega.nz
    - mega.co.nz
    - wetransfer.com
    - send.exploit.in
    - anonfiles.com
    - gofile.io
    - transfer.sh
    - file.io
  condition: selection and selection_method and selection_services
falsepositives:
- Employees legitimately using approved file-sharing tools for large business file
  transfers
- Automated backup jobs configured to sync to consumer cloud storage
level: medium
id: 8f2db80e-b4fc-5007-9da9-257d65a22a7a
status: experimental
author: Vorant
```

### Single Domain Account Authenticating to Unusually High Number of Distinct Hosts

ATT&CK: T1078.002

Detects a single domain account performing interactive or network logons across many distinct workstations/servers in a short window, consistent with a compromised employee credential being reused by an intruder to move laterally past network segmentation; the count/timeframe threshold should be tuned and enforced in the SIEM correlation layer rather than in the rule condition. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Single Domain Account Authenticating to Unusually High Number of Distinct Hosts
description: Flags authentication events (logon type 3 network or 10 remote-interactive)
  for a single non-service domain account observed against many distinct destination
  hosts. This is intended as a building block for a correlation search that counts
  distinct TargetComputer/DestinationHostname per Account within a rolling window
  (e.g. more than 5 hosts in 30 minutes) - encode the count/timeframe in your SIEM's
  correlation rule, not in this base detection, since a compromised reservations/front-office
  style account moving laterally past segmentation is the described behaviour.
tags:
- attack.lateral_movement
- attack.t1078.002
logsource:
  category: authentication
  product: windows
detection:
  selection:
    LogonType:
    - 3
    - 10
    TargetUserName|contains: \
  filter_service_accounts:
    TargetUserName|startswith:
    - svc_
    - SYSTEM
    - NETWORK SERVICE
  condition: selection and not filter_service_accounts
falsepositives:
- Domain administrators or helpdesk accounts that routinely connect to many hosts
  for support
- Shared service or monitoring accounts not excluded by the naming-convention filter
level: low
id: 5d7003f4-0912-5c77-8fcf-3fedf1a8db3f
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ransomware.live/id/QXJrxLFuIEdyb3VwQGJsYWNrbmV2YXM=

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/4c6d3b0f-6f70-5e56-9449-9284c913abd7/cryptorex-breaches-arkin-hotel-group-casino-data.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup