Krybit ransomware

Who Krybit is

Krybit is an emerging RaaS group that launched in late March 2026, offering affiliates an 80/20 revenue split with support for Windows, Linux, ESXi, and NAS device encryption, and became notable for a public feud with rival group 0APT in which each breached and leaked the other's operator data.

Recorded activity

Disclosures attributed to Krybit in this database run from April 2026 to October 2026, totalling 193 victims — 0.8% of everything tracked here. Krybit has listed victims in 55 countries in this database, most often Mexico, followed by India and France. The sectors appearing most in its listings are Technology, Healthcare, Other.

Indicators of compromise

• 030085f202d1ccb73a0dc0b7eb6e1787
• cf77f86c0724629f2bbc86c489fe42de
• 860fae3fc7db1c1ceb12eb42ce59aee4
• 93f8cb3b8b2e4e4ec8d06263f68c953e

Showing a sample of 4 MD5 on file. Hashes and network indicators published for Krybit. Leak-site addresses are deliberately excluded. Indicators age quickly — treat a match as a starting point for investigation, and an absence of matches as no assurance.

YARA detection rules

/*
krybit ransomware
*/

rule krybit_Ransomnote
{
    meta:
        author = "ransomware.live"
        family = "ransomware.krybit"
        description = "Detects krybit ransomware ransom note or artifact"
        date = "2026-05-04"
        severity = 7
        score = 70

    strings:
        $name1 = "krybit" ascii nocase
        $name2 = "KRYBIT" ascii
        $onion  = "krybit.onion" ascii nocase

    condition:
        any of them
}

Community-contributed rules for Krybit, reproduced as published. Test them against your own corpus before relying on them: rule quality and false-positive behaviour vary by author.