CryptoRex breaches Arkın hotel and casino data
Attackers linked to CryptoRex exfiltrated 1.4TB of guest and casino data from Arkın Group hotels in Northern Cyprus, including passports and AML/KYC records.
Cyclops Threat Intelligence reports that the Arkın Group hotel chain in Northern Cyprus, including The Arkın Colony, The Arkın Iskele, and Arkın Palm Beach with its casino, suffered a large-scale data breach. Attackers gained initial access through a compromised employee account in the reservations department, then used legitimate remote administration tools to escalate privileges, bypass network segmentation, and exfiltrate approximately 1.4 TB of data over an extended period before detection.
The stolen data includes full guest profiles with passport details, financial and payment information, internal CRM notes on VIP clients, and highly sensitive casino records covering player IDs, deposit histories, chip-exchange transactions, and KYC/AML source-of-funds documentation for high rollers. Portions of the archive have already appeared on underground forums, with segments reportedly being auctioned starting at 8 bitcoins. No formal ransom demand had been confirmed at time of reporting, suggesting a data-sale/extortion model rather than classic encryption-based ransomware.
Analysts attribute the intrusion with moderate confidence to a group tracked as "CryptoRex," active since 2023 and known for targeting hospitality and gambling businesses in the Mediterranean region. Beyond reputational damage, the breach poses acute risks: exposed VIP casino profiles could be leveraged for targeted extortion, blackmail, or physical security threats against high-net-worth individuals, while leaked AML/KYC records raise money-laundering scrutiny concerns for the jurisdiction. Affected guests are advised to reissue payment cards, monitor credit activity, and treat unsolicited contact referencing leaked personal details as a likely follow-on social engineering attempt.
Mentioned in this report
Detection guidance
Remote Monitoring & Management Tool Execution Outside Normal IT Context
Detects execution of common remote administration/RMM binaries from non-standard parent processes or user-writable paths, consistent with abuse of legitimate remote access tools for privilege escalation and lateral movement rather than IT-sanctioned deployment. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Remote Monitoring & Management Tool Execution Outside Normal IT Context
description: Detects launch of common RMM/remote-access binaries (AnyDesk, TeamViewer,
ScreenConnect, LogMeIn, Splashtop, etc.) from unusual parent processes (browsers,
office apps, scripting hosts) or from user-writable directories, which is consistent
with an attacker installing and running a legitimate remote-access tool to escalate
privileges and move laterally after initial account compromise, rather than IT staff
deploying it through standard software management.
tags:
- attack.command-and-control
- attack.t1219
logsource:
category: process_creation
product: windows
detection:
selection_tool:
Image|endswith:
- \AnyDesk.exe
- \TeamViewer.exe
- \ScreenConnect.ClientService.exe
- \LogMeIn.exe
- \Splashtop_Streamer.exe
- \ConnectWiseControl.Client.exe
- \ammyy.exe
selection_susp_parent:
ParentImage|endswith:
- \winword.exe
- \excel.exe
- \outlook.exe
- \powershell.exe
- \cmd.exe
- \explorer.exe
selection_susp_path:
Image|contains:
- \Users\
- \AppData\
- \Temp\
- \Downloads\
filter_it_install:
CommandLine|contains:
- --silent-install
- /S /install
condition: selection_tool and (selection_susp_parent or selection_susp_path) and
not filter_it_install
falsepositives:
- IT helpdesk staff manually launching RMM tools from a downloaded installer in Downloads
- Legitimate first-time setup of an approved remote support tool by an end user
level: medium
id: f315c0d8-3303-5774-a4b8-1a2482b404dd
status: experimental
author: Vorant
Large Outbound Data Transfer to Web-Based File Sharing or Storage Service
Detects sustained high-volume outbound web traffic (large upload size, long-lived session) to categorized cloud storage/file-sharing services, consistent with staged bulk exfiltration of stolen data over a legitimate web service rather than a custom C2 channel. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Large Outbound Data Transfer to Web-Based File Sharing or Storage Service
description: Detects proxy/web traffic where a single client sends an unusually large
volume of data to a web/cloud storage or file-sharing category destination over
HTTPS, consistent with exfiltration of large stolen archives over a legitimate web
service (e.g. cloud storage, paste/upload sites) to blend in with normal web traffic.
Intended to be tuned against your proxy's URL/category classification for cloud-storage
and file-sharing categories rather than hard-coded destinations.
tags:
- attack.exfiltration
- attack.t1567
logsource:
category: proxy
product: windows
detection:
selection:
c-uri-scheme: https
cs-category:
- File Storage
- Cloud Storage
- File Sharing
high_volume:
cs-bytes|gt: 500000000
condition: selection and high_volume
falsepositives:
- Legitimate bulk backup jobs or approved cloud-sync clients uploading large datasets
- Media or engineering teams transferring large legitimate files to sanctioned cloud
storage
level: medium
id: 0f195d57-a6b0-5c14-8b19-f6d31636ae26
status: experimental
author: Vorant
Domain Account Interactive Logon Followed by Remote Access Tool Launch
Detects a domain account authenticating interactively or via RDP and, shortly after, launching a remote-access/administration tool - a pattern consistent with a compromised valid account being used to pivot into remote-admin tooling for lateral movement and segmentation bypass. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Domain Account Interactive Logon Followed by Remote Access Tool Launch
description: Detects the behavioural pattern of a domain account performing an interactive
or RemoteInteractive logon (LogonType 2/10) followed by process creation of a known
remote-access/administration binary under that same account session. This models
compromised valid domain accounts being used to launch remote-admin tooling for
privilege escalation and lateral movement across network segments, as opposed to
routine helpdesk-assisted remote sessions.
tags:
- attack.persistence
- attack.t1078.002
logsource:
category: process_creation
product: windows
detection:
selection_rat:
Image|endswith:
- \AnyDesk.exe
- \TeamViewer.exe
- \ScreenConnect.ClientService.exe
- \LogMeIn.exe
- \Splashtop_Streamer.exe
- \ConnectWiseControl.Client.exe
selection_domain_user:
User|contains: \\
filter_service_account:
User|endswith: $
condition: selection_rat and selection_domain_user and not filter_service_account
falsepositives:
- IT administrators using domain accounts to legitimately launch approved remote support
tools
- Scheduled maintenance scripts running under a domain service account (excluded via
machine-account filter)
level: low
id: a9488552-d305-5aef-b0b8-96b80ed3a4fd
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free