krybit
Known ransomware group ACTIVE Currently active
Krybit is an emerging RaaS group that launched in late March 2026, offering affiliates an 80/20 revenue split with support for Windows, Linux, ESXi, and NAS device encryption, and became notable for a public feud with rival group 0APT in which each breached and leaked the other's operator data.
9
Total Claims
2
Critical
—
Records Claimed
6
Industries Hit
Active span: Apr 11, 2026 – May 30, 2026 · 9 organizations targeted
Currently active
Actor Threat Profile
Activity Timeline
Peak: May 2026 (5)Apr 2026
LessMore
May 2026Share this profile
Top Targeted Industries
Healthcare 2
Manufacturing 2
Education 1
Business Services 1
Agriculture and Food Production 1
Technology 1
Tradecraft & Infrastructure
0
Documented tools
0 / 0
MITRE tactics / techniques
4
Known leak sites
Targeted Organizations
Claims by krybit
Critical
Ransomware Claim: tulipmediworld.com
tulipmediworld.com
krybit
Ransomware Healthcare
May 31, 2026 Low
Ransomware Claim: ctps.tp.edu.tw
ctps.tp.edu.tw
krybit
Ransomware Education
May 27, 2026 Low
Ransomware Claim: SARL CANIS EVENTS SÉCURITÉ PRIVÉE
SARL CANIS EVENTS SÉCURITÉ PRIVÉE
krybit
Ransomware Business Services
May 20, 2026 Low
Ransomware Claim: foodsmart.com.do
foodsmart.com.do
krybit
Ransomware Agriculture and Food Production
May 5, 2026 Critical
Ransomware Claim: bomuhospital.org
bomuhospital.org
krybit
Ransomware Healthcare
May 2, 2026 Low
Ransomware Claim: Narteks Tekstil A.S
Narteks Tekstil A.S
krybit
Ransomware Manufacturing
Apr 27, 2026 Low
Ransomware Claim: rhode-hv.de
rhode-hv.de
krybit
Ransomware Manufacturing
Apr 18, 2026 Low
Ransomware Claim: Hacked 0APT
Hacked 0APT
krybit
Ransomware Technology
Apr 15, 2026 Low
Ransomware Claim: conrepsa.ro
conrepsa.ro
krybit
Ransomware
Apr 12, 2026