Ransomware Intelligence

Ransomware needs a way in. Stolen credentials are the cheapest one.

Check Your Exposure

krybit Ransomware Group

Ransomware group profile

172Victims
RussiaSource country
80Impact score

Description

KryBit is a financially motivated ransomware group that emerged in March 2026, offering a Ransomware-as-a-Service model where affiliates retain a significant share of ransom payments. They employ a double-extortion strategy by encrypting files and exfiltrating sensitive data, with notable public conflicts with rival groups contributing to their visibility in the cybercriminal landscape.

Key insights

  • Utilizes a double-extortion model, encrypting files and stealing data.
  • Targets multiple operating systems, including Windows, Linux, and ESXi.
  • Ransom demands range between $40,000 to $100,000.
  • Employs complex evasion techniques, including shadow copy deletion and process injection.
  • Communicates with victims through Tor-based channels for negotiations.
  • Engages in inter-group conflicts that result in operational revelations.
  • Initial access often gained through phishing and exploited services.

Threat Level & Status Breakdown

For krybit · Based on incidents in selected period

4.3threat level
Aggressiveness10/ 10
Lethality0/ 10
Criticality2.6/ 10

Status Breakdown

Claimed100.0%172
First seenApr 2026
Last seenSep 2026
Avg ransom
Payment rate
Statusactive
Sophistication0
Last updatedSep 18, 2026

Recent activity

Monthly attack count for krybit in the selected period

172Total attacks
45peak in Jul
28.7avg / month
↑ 7 vs first month
AprMayJunJulAugSep015304560

Intelligence

IOCs, YARA/Sigma rules, and related families for krybit

  1. 93f8cb3b8b2e4e4ec8d06263f68c953e
  2. cf77f86c0724629f2bbc86c489fe42de
  3. 030085f202d1ccb73a0dc0b7eb6e1787
  4. 860fae3fc7db1c1ceb12eb42ce59aee4
View full IOC feed7 total

TTPs & Attack Vectors

Tools, initial access, and MITRE ATT&CK techniques for krybit

CVE-2022-40684
Other

T1486

T1486

T1490

T1490

T1078

T1078

T1562

T1562

T1059

T1059

T1021

T1021

T1547

T1547

T1021.001

T1021.001

T1105

T1105

T1037

T1037

T1071

T1071

T1041

T1041

Victims(156)

TurkeyOtherharputyapi.com
Claimed
about 14 hours ago
GermanyHealthcarediakonie-apolda.de
Claimed
about 14 hours ago
United Arab EmiratesHospitalitykashkha.com
Claimed
5 days ago
GeorgiaHospitalitytiflispalace.ge
Claimed
6 days ago
MexicoGovernment & Defensetender.mx
Claimed
6 days ago
South AfricaTransportationcapricornlogistics.com
Claimed
6 days ago
United Arab EmiratesHealthcareibnsinatrust.com
Claimed
6 days ago
MoroccoHospitalitylasultanahotels.com
Claimed
6 days ago
FranceOthereracm.fr
Claimed
6 days ago
HaitiProfessional Servicespss.ht
Claimed
6 days ago
CanadaManufacturingmetalware.ca
Claimed
6 days ago
United Arab EmiratesProfessional Servicesintherpro.com
Claimed
6 days ago
CroatiaProfessional Servicesmeridian16.hr
Claimed
6 days ago
KenyaTransportationeac-airports.com
Claimed
6 days ago
IndiaManufacturingswadeshicipl.com
Claimed
6 days ago
GuatemalaHealthcareincan.org.gt
Claimed
15 days ago
GuatemalaHealthcareligacancerguate.org
Claimed
15 days ago
IndiaHealthcareseashellhospital.com
Claimed
17 days ago
SwitzerlandProfessional Servicesuicc.org
Claimed
17 days ago
MexicoEducationtum.com.mx
Claimed
17 days ago

Page 1 of 8