The Crypto24 ransomware group, identified in September 2024, employs advanced tactics to disable antivirus protections before launching attacks. They use a custom variant of the open-source tool RealBlindingEDR.malware to neutralize AV defenses, sometimes uninstalling antivirus programs entirely. After gaining access to a target system, they deploy a keylogger and an encryptor, exfiltrating data to Google Drive with a specialized tool. The group has targeted large organizations in the U.S., Europe, and Asia, focusing on sectors like finance, manufacturing, technology, and entertainment. Cybersecurity experts recommend a layered defense strategy, including reputable antivirus solutions with tamper protection, real-time monitoring, firewalls, and additional anti-malware tools to mitigate risks.