Overview
Krybit is an emerging RaaS group that launched in late March 2026, offering affiliates an 80/20 revenue split with support for Windows, Linux, ESXi, and NAS device encryption, and became notable for a public feud with rival group 0APT in which each breached and leaked the other's operator data.
- First tracked: 2026-04-03
- Discussed in our reports: France · Gulf summary · Maghreb · Saudi Arabia · Türkiye · UAE
What public reporting says
- First seen in late March 2026. In April it clashed publicly with a rival group, 0APT: Krybit breached 0APT, defaced its leak site and published its operational data, which showed 0APT’s large victim count was fabricated.
Geography: origin and targets
No public attribution of origin. Lines are drawn only where public reporting places the operators; flags show where the group has claimed victims, sized by number of claims.
India12
Mexico12
Germany10
France9
Brazil8
South Africa5
Thailand5
United States of America5
Taiwan, Province of China5
Singapore4
Exploited vulnerabilities
None recorded in the sources we reviewed.
ATT&CK techniques
None recorded in the sources we reviewed.
Tools
None recorded in the sources we reviewed.
Leak-site infrastructure
| Title | Type | Address (defanged) | Seen online at snapshot |
|---|---|---|---|
| KRYBit | Leaks | DLS | krybivdln3oc3twbin4budgznzq7dmcolldnsx455lspxxe23b56y5qd[.]onion | Yes |
| — | DLS | krybitqsdzwmhnitvwuhvsntfgf2wrhxveyxroxpc44c6gkft2cqldyd[.]onion | No |
| — | DLS | krybitqsdzwmhnitvwuhvsntfgf2wrhxveyxroxpc44c6gkft2cqldyd[.] | No |
| — | DLS | krybieodq754vlwufrsuxaswxb5zpxyibaawmed2jaduoz2e5m56hmid[.]onion | No |
| — | DLS | krybitxdpxohsmjooeb3gbgpmdddreh6mnflzac6bnezz74b7yje67yd[.]onion | No |
| — | DLS | krybitx3fh5krdnhegyp2ob3lhizsaiadturtio3ginf7it5gsdgu2yd[.]onion | No |
Sources and caveats
Group descriptions, ATT&CK mappings, tools and leak-site locations come from public ransomware tracking projects, including ransomware.live and Crocodyli. Exploited vulnerabilities come from the Ransomware-Vulnerability-Matrix by BushidoUK (licensed CC BY 4.0), supplemented where a group profile there is newer than the data we hold. Each CVE links to its original research source. Technical text is shown in English as published. Leak-site addresses are defanged and shown for blocking and detection; do not visit them. Nothing here is verified by ClairSec_ against a specific incident.
Data snapshot: 2026-10-11