What is Krybit?
Krybit is the name of a ransomware-as-a-service (RaaS) operation that first surfaced in early 2026. The group rents out the ransomware it has developed to affiliates who carry out attacks on its behalf, splitting ransoms extorted from victims 80:20 (80% to affiliates, 20% to the Krybit operators) in exchange for access to the malware, a dashboard, and round-the-clock technical support.
And I'm guessing it follows the normal rules of ransomware?
Yes. As with most other modern ransomware operations, Krybit steals data before encrypting the original copies, threatening to publish the information it has exfiltrated on its leak site if the victim does not give in to the extortionists' demands.
How will I know if my company has been hit by Krybit?
The most obvious clue is if you find your files have been renamed with a .KRYBIT extension. Furthermore, the ransomware drops a file (RECOVER-README.txt) which informs you that "all of your files are encrypted and stolen" and that if you upload "an unimportant" encrypted file to the gang's dark web site they will decrypt it to prove that data can be recovered. Some anti-virus products identify samples of Krybit as being related to the Babuk ransomware, which is no surprise as it was based upon the source code of Babuk which leaked online in 2021.
You're saying that Krybit couldn't even bother to write their own ransomware?
They are far from alone in basing their ransomware on leaked code — there have been many examples of ransomware derived from the Babuk code, whose source was leaked in 2021. That leak included encryptors for Windows, NAS devices and VMware ESXi, and Krybit is reported to target those platforms too, as well as Linux.
Nasty. Who has fallen foul of Krybit?
On its leak site Krybit claims that it has hit a variety of organisations, including an Auckland-based IT services provider in New Zealand, Bolivia's national commercial registry, Northern Access Transportation, and ASHA Microfinance Bank. The location of companies hit by Krybit have been concentrated in Europe, but there have also been victims in Asia and Latin America. Those who track the group's activities says that the biggest concentration of victims appears to be in Germany, Italy, and Taiwan, across various industry sectors including technology, business services, and transportation and logistics.
And how much money do they demand?
Ransom demands of between US $40,000 and $100,000 worth of cryptocurrency have been reported by one tracker, which — together with the list of victims published on its leak site — suggests that Krybit is not just chasing large multinationals.
They sound like a mean bunch
They don't have everything their own way. For instance, in April 2026, a rival RaaS gang called 0APT broke into Krybit's systems and published its contents, reportedly exposing two of the group's administrators, five affiliates, and 20 organisations midway through negotiating ransom payments. 0APT demanded US $2 million worth of cryptocurrency from Krybit to stop it from leaking more information.
And what happened?
Within a couple of days, Krybit struck back — hacking 0APT's infrastructure and defacing its leak site with a simple message:
"HACKED BY KRYBIT — Next time, don't play with the big boys"
Krybit then listed 0APT as one of its victims on its own leak site, and published information implying that 0APT's claims of having hit around 200 victims were largely fictitious.
But if information had already leaked from Krybit — wouldn't that be of assistance to researchers and the authorities?
Potentially... For now, Krybit remains online and its attacks continue.
So how does Krybit initially attack an organisation?
As the actual attacks are coordinated by affiliates, the methods can vary. However, common methods to gain initial access to systems are believed to include phishing attacks and the use of credentials harvested by info-stealing malware. Once they have gained access, attackers typically delete Volume Shadow Copies to make it harder for victims to recover, and take advantage of existing legitimate software to avoid detection.
What should organisations do to protect themselves?
As ever, hardening your security and following best practices can go a long way to stop ransomware attacks like those perpetrated by Krybit from succeeding. Advice includes:
- Enforcing multi-factor authentication on Microsoft 365, VPNs, and anything else used to gain remote access to systems.
- Lock down ESXi management interfaces so they can only be accessed from dedicated administrative networks.
- Keep offline, immutable backups, stored physically separate from your production environment.
- Monitor for suspicious activity, such as shadow copies being deleted, or unusual outbound data traffic that could indicate information is being exfiltrated by an attacker before encryption begins.
- Keep up-to-date with the latest security patches — especially for systems that are internet-facing.
- Have an incident response plan ready, and test that it works prior to an attack occurring.
