CRPx0 Ransomware Data Exfiltration via CrpxBoundary Multipart Upload

Ibrahim Saud@tektrix

•updated Sep 18, 2026•2•0•8

Detects anomalous POST requests containing the 'CrpxBoundary' string sent to a '/relay.php' endpoint. This signature is associated with the pre-encryption data exfiltration phase of CRPx0 ransomware.