Ransomware Intelligence

Latest Research on INC and The Gentlemen Ransomware: Exposed AI Infrastructure

Read the Research

krybit Ransomware Group

Ransomware group profile

192Victims
RussiaSource country
80Impact score

Description

KryBit is a financially motivated ransomware group that emerged in March 2026, offering a Ransomware-as-a-Service model where affiliates retain a significant share of ransom payments. They employ a double-extortion strategy by encrypting files and exfiltrating sensitive data, with notable public conflicts with rival groups contributing to their visibility in the cybercriminal landscape.

Key insights

  • •Utilizes a double-extortion model, encrypting files and stealing data.
  • •Targets multiple operating systems, including Windows, Linux, and ESXi.
  • •Ransom demands range between $40,000 to $100,000.
  • •Employs complex evasion techniques, including shadow copy deletion and process injection.
  • •Communicates with victims through Tor-based channels for negotiations.
  • •Engages in inter-group conflicts that result in operational revelations.
  • •Initial access often gained through phishing and exploited services.

Threat Level & Status Breakdown

For krybit · Based on incidents in selected period

4.2threat level
Aggressiveness10/ 10
Lethality0/ 10
Criticality2.5/ 10

Status Breakdown

Claimed100.0%192
First seenApr 2026
Last seenOct 2026
Avg ransom—
Payment rate—
Statusactive
Sophistication0
Last updatedOct 27, 2026

Recent activity

Monthly attack count for krybit in the selected period

192Total attacks
45peak in Jul
27.4avg / month
↓ 7 vs first month
AprMayJunJulAugSepOct015304560

Intelligence

IOCs, YARA/Sigma rules, and related families for krybit

  1. 93f8cb3b8b2e4e4ec8d06263f68c953e
  2. cf77f86c0724629f2bbc86c489fe42de
  3. 030085f202d1ccb73a0dc0b7eb6e1787
  4. 860fae3fc7db1c1ceb12eb42ce59aee4
View full IOC feed7 total

TTPs & Attack Vectors

Tools, initial access, and MITRE ATT&CK techniques for krybit

CVE-2022-40684
Other

T1486

T1486

T1490

T1490

T1078

T1078

T1562

T1562

T1059

T1059

T1021

T1021

T1547

T1547

T1021.001

T1021.001

T1105

T1105

T1037

T1037

T1071

T1071

T1041

T1041

Victims(176)

United StatesRetail & E-Commercechoicegoodwill.com
Claimed
4 days ago
MalaysiaRetail & E-Commercemainplace.com.my
Claimed
4 days ago
EgyptManufacturing
Claimed
4 days ago
IndiaProfessional Serviceszhservices.com
Claimed
4 days ago
MexicoManufacturinggrupoeuro.com.mx
Claimed
4 days ago
CanadaTechnologyoptika.ca
Claimed
4 days ago
TurkeyOtherharputyapi.com
Claimed
5 days ago
diakonie-apolda.de
Claimed
5 days ago
acilnet.com
Claimed
5 days ago
FranceTechnologyeuroditel.com
Claimed
24 days ago
ColombiaRetail & E-Commercesuperpack.com.co
Claimed
24 days ago
EgyptHealthcaredaralteb.com
Claimed
24 days ago
Czech Republickres.cz
Claimed
26 days ago
IndiaRetail & E-Commerceraajratna.com
Claimed
26 days ago
FranceOtherpierrefeu.fr
Claimed
26 days ago
IndiaEducationsai.org.in
Claimed
26 days ago
United StatesManufacturingdiskprecision.com
Claimed
27 days ago
Saudi ArabiaFinancial Servicesefada.sa
Claimed
about 1 month ago
Tanzaniaairtanzania.com
Claimed
about 1 month ago
Australiajonesthegrocer.com
Claimed
about 1 month ago

Page 1 of 9