Sumoteks Tekstil Data Breach

krybit, a ransomware-as-a-service operation, added Sumoteks Tekstil Ürünleri Üretim ve Pazarlama Limited Şirketi (sumoteks[.]com) to its leak portal on November 9, 2026. The victim is a Turkey-based technology and textile manufacturing company, and SOCRadar identified the listing while monitoring the group’s leak site. Turkey is a core krybit target geography, so the listing fits the group’s established pattern rather than standing out as an anomaly. The claim follows the group’s standard double-extortion approach, in which files are encrypted, data is exfiltrated, and a ransom is demanded, although the listing itself has not been independently verified. krybit operates as a ransomware-as-a-service platform and has claimed 39 other victims over the past 60 days, with Technology and Manufacturing standing out as its primary targeted sectors. Prior listings attributed to the group include Ahluwalia Contracts (India) Limited, UNIC Technology (Thailand) Co., Ltd., www.optika.ca, and Groupe Euroditel. The addition of Sumoteks Tekstil matches this recent activity closely: the victim sits in a core target geography for the group, and its combined technology and manufacturing profile aligns with the industries krybit attacks most frequently. This geographic and sector overlap makes Sumoteks Tekstil a representative example of the group’s current targeting rather than a deviation from it.

SOCRadar’s stealer-log telemetry returned a severe result for sumoteks[.]com: three employee credentials, associated with corporate @sumoteks[.]com email addresses, were found in infostealer datasets targeting Microsoft identity infrastructure. The exposed endpoints include the Microsoft 365 tenant login endpoint and an ADFS instance. Compromised Microsoft identity credentials provide direct pathways into cloud-hosted applications, enterprise email, and potentially endpoint and device-management systems. This is exactly the initial access profile that krybit affiliates source from underground markets and validate before staging a ransomware deployment, which gives the exposure practical significance beyond the leak-site claim itself. For ransomware groups such as krybit, infostealer-harvested credentials are a well-documented initial access vector. Operators or initial access brokers source fresh logs from underground marketplaces, validate the corporate credentials, and use them to log into Microsoft 365, VPN, or remote-access portals before deploying ransomware. While the stealer-log evidence does not confirm that these specific credentials were used by krybit, the pattern is consistent with the kill chain typically observed for this class of incident, particularly where Microsoft identity endpoints are among the exposed assets. The presence of credentials against both a Microsoft 365 tenant and an ADFS instance means the exposed identity surfaces span cloud authentication as well as federation infrastructure. CTI teams monitoring this victim should treat the exposed Microsoft identity credentials as priority indicators. The immediate step supported by the evidence is to cross-reference the affected accounts against internal access logs to determine whether any unauthorized access has already occurred, with particular attention to Microsoft 365 and ADFS authentication activity. Continued monitoring of stealer-log feeds for the corporate domain and of the group’s leak portal remains advisable while the claim is active.