White-label is the detail that breaks the counting. CRPx0 sells buyers the resources to run campaigns under the buyer's own name [9], so the brand printed on a ransom note carries no fixed relationship to the crew that got in. A leak site is a marketing surface. The name on it is the cheapest part to change.
The economics run the same direction. The advertised 100 percent profit share [10] sits ten points above the 90 percent Bitdefender describes as the previous high, offered by groups such as The Gentlemen [11][2]. Behind that headline number, an affiliate page lists 70 percent [12], a 30-point spread between the pitch and the documented rate [3]. The fixed item is the $10,000 one-time subscription fee for platform access [10]. A seller who collects nothing from ransoms and everything at signup is paid for the appearance of volume. Bitdefender reads the move off an RaaS-only model as either recruitment or a scam aimed at affiliate hopefuls [18], and notes the group is marketing a separate Hacking-as-a-Service line covering data breach and network compromise [13].
Bitdefender offers two readings of July's near-synchronous ransom countdowns and leaves the question open between them: inflation to build trust with prospective buyers [14], or real access to several breach datasets at once, struck in parallel [15]. Both readings damage the number. If CRPx0 did not run the original intrusions and received victim data from an outside source, Bitdefender says the claims are far less credible [16].
Arithmetic on the leaderboard: 46 of 873 is 5.3 percent of everything claimed in July [1], from a group that had under ten listings the month before [3], a rise of at least 4.6 times in four weeks [4]. That single brand moves the monthly total more than most established operations, and the growth came with a client-base change from small dental practices to larger technology and financial services organisations inside two weeks [5].
The Turkish cluster is the clearest test. Victims there were published in close succession, which Bitdefender says resembles Qilin's Korean Leaks operation [7], and it states plainly that there is no information tying the activity to a widespread supply chain compromise of Turkish organisations [8]. The pattern is there. The cause is not.
The tooling matches what everyone else is running, which leaves little to sort on. Living off the Land payloads for encryption and ClickFix lures on fake CAPTCHA pages are, by Bitdefender's own account, not unique to this group [17]. What separates a capable operation from a reseller is the intrusion evidence in the victim's logs, not the row count on a monthly chart that its publisher says it cannot independently verify [2].
