Summary
On July 16, 2025, the ransomware group Crypto24 publicly claimed responsibility for an attack targeting
Warisan TC Holdings Berhad (warisantc.com), a Malaysia-based company specializing in business services.
The threat actors have exfiltrated over 300GB of sensitive data and are threatening to release it unless negotiations are initiated.
Incident Report
| Field | Details |
|---|---|
| Target | Warisan TC Holdings Berhad |
| Domain | warisantc.com |
| Country | Malaysia |
| Attacking Group | Crypto24 |
| Date Reported | July 16, 2025 |
| Threat Actor Statement | “We have exfiltrated over 300GB of sensitive data, including Customer databases (all dbs of wtc – TOURPLAN, CRM, E-INVOICE,…), Legal and HR documents, Financial and employee records, Contractual documents with partners and customers.” |
Warisan TC Holdings Berhad, a prominent player in the business services sector, has become the latest victim of a sophisticated ransomware attack. The attackers, identified as the Crypto24 group, have claimed responsibility and are known for their aggressive tactics.
It’s crucial for organizations to be proactive about cybersecurity threats. One effective measure is darkweb monitoring, which can help detect potential data leaks and threats early. Companies are encouraged to use tools like the email breach checker available at MSP DarkIntel to monitor for breaches and protect their assets.
Recommendations
- Monitor your domains and email addresses for exposure using reputable threat intelligence tools.
- Conduct a full compromise assessment and incident response drill internally.
- Verify backups and ensure they are offline and ransomware-resistant.
- Educate staff on phishing, social engineering, and lateral movement techniques used by groups like Qilin.
- Engage with cyber forensics and legal counsel before initiating contact with threat actors.
Check Your Exposure
Wondering if your organization or employees are impacted by recent breach activity?
-
Check domain-wide breach exposure:
mspdarkintel.com/domain-breach-scan -
Check if an email was breached:
mspdarkintel.com/email-breach-scan
Disclaimer
The MSPDarkIntel team does not engage in the exfiltration, downloading, taking, hosting, viewing, reposting, or disclosure of any stolen information.
All breach data reported here is sourced from publicly available threat intelligence feeds for awareness and early-warning purposes only.
Our goal is to inform organizations of emerging threats so they can take timely defensive action.
Table of Contents
