Krybit

KryBit is a newly identified ransomware-as-a-service (RaaS) operation and ransomware gang. Reporting in the provided content describes it as a nascent and less well-documented group that may have only been active for a few weeks at the time of reporting, with no major threat intelligence or cybersecurity organization yet having published a dedicated report on it. Known alias in the content: krybit / KryBit. The group was mentioned among active ransomware groups generating victims across multiple sectors, including education and healthcare. The content also describes a public conflict between KryBit and rival ransomware group 0APT. In one phase of that dispute, 0APT claimed to have stolen KryBit data, threatened to expose people affiliated with KryBit, and leaked a sample that Barricade Cyber Solutions said contained plaintext credentials belonging to KryBit operators and affiliates, as well as five cryptocurrency wallet addresses. Barricade Cyber Solutions also reported finding no evidence of a paid ransom in the leaked sample. KryBit's website was reported down at the time, showing a temporary maintenance-style splash page. In a subsequent reported retaliation, KryBit allegedly compromised 0APT and exposed 0APT’s operational information, including access logs, system files, and PHP source code. The content characterizes this as criminal-on-criminal infighting within the ransomware ecosystem. No nation-state attribution is provided in the content.