National Investment Holding Company Data Breach

National Investment Holding Company (NIC Libya, niclibya[.]com), a Libyan financial holding and investment organization, was listed as a victim on the krybit ransomware group’s dark web leak portal on November 9, 2026. The listing was identified through SOCRadar’s Dark Web Monitoring service. Its appearance extends krybit’s reach into North African financial sector targets — a geographic outlier for the group, but consistent with its established pattern of opportunistic multi-sector targeting. The listing of a national-level financial holding organization in Libya underscores the group’s willingness to pursue targets outside its established regional concentrations. In the 60 days prior to this listing, krybit claimed 39 other victims, demonstrating a broad targeting pattern spanning the Technology, Manufacturing, and Retail & E-Commerce sectors, with victim concentration in India, France, and Turkey. Other recent krybit listings in adjacent contexts include Pierrefeu Immobilier, efada, ERACM (École Régionale d’Acteurs de Cannes et Marseille), and Sumoteks Tekstil Ürünleri Üretim ve Pazarlama Limited Şirketi. The National Investment Holding Company claim differs from this recent activity in both geography and sector: Libya sits outside the group’s leading victim countries, and the financial sector does not rank among its most frequently targeted industries. At the same time, the listing is consistent with krybit’s opportunistic approach, in which targets are pursued across a wide range of sectors and regions rather than a single narrow victim profile.

SOCRadar’s stealer-log telemetry surfaced a severe exposure for the niclibya[.]com domain: 13 credentials classified as internal-auth employee records (category A). The exposed records cover access to the organization’s Microsoft 365 tenant identity provider, webmail infrastructure, FTP services, and the primary corporate domain. The concentration of identity and infrastructure credentials within a single sample points to a corporate intrusion risk profile — the exposed access scope encompasses both cloud-based identity and on-premises infrastructure components that are typical precursors to ransomware staging. For ransomware groups such as krybit, infostealer-harvested credentials are a well-documented initial access vector: operators or initial access brokers source fresh logs from underground marketplaces, validate the corporate credentials, and use them to log into Microsoft 365, VPN, or remote-access portals before deploying ransomware. The stealer-log evidence in this case does not confirm that these specific credentials were used by krybit. However, the breadth of the exposed access — spanning identity, mail, FTP, and primary domain endpoints — represents a comprehensive foothold characteristic of the type of access ransomware actors seek prior to lateral movement. The telemetry should therefore be read as an observed exposure that could plausibly support an intrusion path of this kind, rather than as proof of the exact technique used against the organization. CTI teams should treat these findings as elevated-priority indicators warranting immediate credential rotation and access review across all exposed infrastructure. Because the exposed records span both cloud-based identity and on-premises components, the review should cover the full scope reflected in the telemetry, including the Microsoft 365 tenant identity provider, webmail, FTP services, and the primary corporate domain. Verifying that the exposed credentials have been invalidated and confirming the integrity of access to each affected service would limit the window in which any of the 13 records could still enable unauthorized entry.