KryBit is a financially motivated ransomware group that emerged in March 2026, offering a Ransomware-as-a-Service model where affiliates retain a significant share of ransom payments. They employ a double-extortion strategy by encrypting files and exfiltrating sensitive data, with notable public conflicts with rival groups contributing to their visibility in the cybercriminal landscape.
Key insights
•Utilizes a double-extortion model, encrypting files and stealing data.
•Targets multiple operating systems, including Windows, Linux, and ESXi.
•Ransom demands range between $40,000 to $100,000.
•Employs complex evasion techniques, including shadow copy deletion and process injection.
•Communicates with victims through Tor-based channels for negotiations.
•Engages in inter-group conflicts that result in operational revelations.
•Initial access often gained through phishing and exploited services.