Ransomware needs a way in. Stolen credentials are the cheapest one.
Kryptos Ransomware Ransomware Group
Ransomware group profile
Description
Kryptos is a newly emerged Ransomware-as-a-Service (RaaS) operation that began in October 2025, quickly targeting mid-sized organizations with a focus on data exfiltration and extortion. The group utilizes a rapid attack-to-claim cycle, averaging just one day between initial breach and ransom disclosure.
Key insights
- •Operates through a Ransomware-as-a-Service model, allowing affiliates to deploy their ransomware.
- •Employs double-extortion tactics, threatening both data encryption and public release of stolen information.
- •Targets mid-sized firms, specifically within professional services and critical sectors.
- •Initial access likely gained via phishing or exploited vulnerabilities.
- •Uses a TOR-based dark web portal for its operations and data leak site.
Threat Level & Status Breakdown
For Kryptos Ransomware · Based on incidents in selected period
Status Breakdown
Recent activity
Monthly attack count for Kryptos Ransomware in the selected period
Intelligence
IOCs, YARA/Sigma rules, and related families for Kryptos Ransomware
- kryptospnjzz7vfkr663bnqv3dxirmr3svo5zwq7cvu2wdfngujgknyd.onion
TTPs & Attack Vectors
Tools, initial access, and MITRE ATT&CK techniques for Kryptos Ransomware
T1486
T1486
T1041
T1041
T1490
T1490
T1078
T1078
T1562
T1562
T1021
T1021
T1059
T1059
T1547
T1547
T1203
T1203
T1071.001
T1071.001
T1047
T1047
Victims(2)
| Company | Country | Status | Discovered | |
|---|---|---|---|---|
| Provincial Department of Health Services | Sri Lanka | Claimed | 11 months ago | |
| Adichunchanagiri Institute Of Technology | India | Claimed | 11 months ago |
Affected countries(6)
Countries where this group has been reported to target or leak victims.