suncrypt

SunCrypt is a ransomware group active since 2019 that joined the Maze ransomware cartel in 2020, adopting the double-extortion model and sharing infrastructure with Maze, RagnarLocker, and LockBit. The group strictly avoids encrypting systems in Russia, Ukraine, Belarus, Kyrgyzstan, and Syria — strong indicators of Russian or CIS-origin operators — and has been linked by Intezer researchers to the QNAPCrypt ransomware family through shared code. SunCrypt operated at relatively low volume and has persisted intermittently through 2022, with most activity targeting organizations in the United States and Europe.