Ransomware Group intelligence
Krybit
ActiveTrack Krybit with 162 published victims and 6 known leak locations in a single intelligence view.
BREACH HOUSE ALERTS
Want an alert every time a new ransomware post is published?
Choose the feeds and the countries you care about — we email you when they move.
Overview
Krybit is tracked by Breach House as a ransomware group with 162 published victims.
India is currently the most targeted country in this dataset.
6 known leak locations are currently associated with this group.
Leak Status Distribution
162
- Leaked 46 28.4%
- Pending 115 71.0%
- Deleted 1 0.6%
Top Countries
Interactive distribution based on the currently visible victims list.
Known Leak Locations (6)
| Label | Type | Availability | Links |
|---|---|---|---|
| Leak location 6 | Onion service | Up checked 4h ago | krybivdln3oc3twbin4budgznzq7dmcolldnsx455lspxxe23b56y5qd.onion |
| Leak location 5 | Onion service | Up checked 4h ago | krybieodq754vlwufrsuxaswxb5zpxyibaawmed2jaduoz2e5m56hmid.onion |
| Leak location 4 | Onion service | Up checked 4h ago | krybitxdpxohsmjooeb3gbgpmdddreh6mnflzac6bnezz74b7yje67yd.onion |
| Leak location 1 | Onion service | Up checked 4h ago | krybitqsdzwmhnitvwuhvsntfgf2wrhxveyxroxpc44c6gkft2cqldyd.onion |
| Leak location 3 | Onion service | Up checked 4h ago | krybitx3fh5krdnhegyp2ob3lhizsaiadturtio3ginf7it5gsdgu2yd.onion |
| Leak location 2 | Web location | Down checked 4h ago | krybitqsdzwmhnitvwuhvsntfgf2wrhxveyxroxpc44c6gkft2cqldyd. |
Top Activity Sectors (16)
- IT 27
- Manufacturing / Engineering 18
- Not identified 17
- Finance / Legal / Insurance 14
- Services 13
- Transportation / Travel / Logistics 12
- Retail / E-commerce 11
- Construction / Real Estate 8
- Healthcare / Pharma 7
- Public Sector 7
- Education 7
- Hospitality / Food & Beverage / Tourism 4
- Telecommunications 3
- NGOs / Associations 3
- Agriculture / Food 3
- Energy 3
Typical Attacks (10)
▼MITRE ATT&CK does not currently catalogue Krybit, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v20.0. Confidence: medium. Treat it as orientation, not attribution.
-
T1059.001 PowerShell Execution
What they do: krybit leverages PowerShell scripts to stage initial execution and automate lateral movement across endpoints.
What that means: Adversaries may abuse PowerShell commands and scripts for execution.
-
T1106 Native API Execution
What they do: krybit uses native API calls to execute malicious payloads and bypass host-based execution controls.
What that means: Adversaries may interact with the native OS application programming interface (API) to execute behaviors.
-
What they do: krybit modifies registry run keys to ensure malware persistence across reboots on compromised systems.
What that means: Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key.
-
T1685 Disable or Modify Tools Defense Impairment
What they do: krybit disables antivirus tools and security software to prevent detection and hinder incident response.
What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
-
T1070.004 File Deletion Stealth
What they do: krybit deletes Volume Shadow Copies and backup directories to eliminate recovery options for victims.
What that means: Adversaries may delete files left behind by the actions of their intrusion activity.
-
T1057 Process Discovery Discovery
What they do: krybit performs process discovery to identify critical services and isolate high-value targets for disruption.
What that means: Adversaries may attempt to get information about running processes on a system.
-
T1021.002 SMB/Windows Admin Shares Lateral Movement
What they do: krybit exploits SMB/Windows Admin Shares to move laterally within manufacturing and engineering networks.
What that means: Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).
-
T1041 Exfiltration Over C2 Channel Exfiltration
What they do: krybit exfiltrates stolen data over C2 channels before deployment to enable double extortion tactics.
What that means: Adversaries may steal data by exfiltrating it over an existing command and control channel.
-
T1486 Data Encrypted for Impact Impact
What they do: krybit encrypts victim files using custom ransomware routines, locking business data for extortion demands.
What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
-
T1490 Inhibit System Recovery Impact
What they do: krybit invokes system recovery inhibition commands to prevent automated restoration of encrypted files.
What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.
Ransom Notes (1)
▼The note this group leaves on a compromised machine. Click a filename to read it.
README-RECOVER.txt
--KRYBIT Your network/system was encrypted. Encrypted files have new extension. --Blog http://krybitxdpxohsmjooeb3gbgpmdddreh6mnflzac6bnezz74b7yje67yd.onion/ http://krybitx3fh5krdnhegyp2ob3lhizsaiadturtio3ginf7it5gsdgu2yd.onion/ http://krybitqsdzwmhnitvwuhvsntfgf2wrhxveyxroxpc44c6gkft2cqldyd.onion/ http://krybieodq754vlwufrsuxaswxb5zpxyibaawmed2jaduoz2e5m56hmid.onion/ -- Compromising and sensitive data We have downloaded compromising and sensitive data from you system/network If you refuse to communicate with us and we do not come to an agreement, your data will be published. Data includes: - Employees personal data, CVs, DL , SSN. - Complete network map including credentials for local and remote services. - Financial information including clients data, bills, budgets, annual reports, bank statements. - Complete datagrams/schemas/drawings for manufacturing in solidworks format - And more... -- Warning If you modify files - our decrypt software won't able to recover data If you use third party software - you can damage/modify files (see item 1) You need cipher key / our decrypt software to restore you files. The police or authorities will not be able to help you get the cipher key. We encourage you to consider your decisions. -- Recovery 1) Download tor browser: https://www.torproject.org/download/ 2) Visit the chat: http://krybitx3fh5krdnhegyp2ob3lhizsaiadturtio3ginf7it5gsdgu2yd.onion/chat/[snip]/ 3) Use this ID to log in: [snip] 4) Supp: 071EA649F06BDB7123C99653B7371E3B59860EE405E66A31EE0FD385F745A000405B6846ECBC
Ransom-note text from RansomLook, licensed CC BY 4.0.
Victims (162)
Search, filter and paginate the victim timeline for Krybit. Showing 101–162 of 162.
| Type | Target | Discovered | Country | Business Category | Intel Link | Leak status |
|---|---|---|---|---|---|---|
| Ransomware | TRANSPORTES Y LOGISTICA BRAS, S.A id30146 View details | Spain | Transportation / Travel / Logistics | pending | ||
|
***.A. is a Guatemalan company specializing in heavy land transport and logistics services, ... |
||||||
| Ransomware | aai.com.tw id30147 View details | Taiwan, Province of China | Manufacturing / Engineering | pending | ||
|
AeroVision Avionics, Inc. (AAI) (利翔航太電子股份有限公司) is a Taiwanese high-tech company incorporated in ... |
||||||
| Ransomware | www.northern-access.com id30148 View details | Canada | Transportation / Travel / Logistics | pending | ||
|
Northern Access Transportation, Inc. is a locally owned American company founded in Duluth, Minnesota, USA, dedicated to... |
||||||
| Ransomware | moscati.org id30149 View details | Italy | NGOs / Associations | pending | ||
|
Hôpital Catholique Saint Joseph Moscati (***.org) is a Catholic hospital operating under the motto "Foi et charité... |
||||||
| Ransomware | ford.mx id30054 View details | Mexico | Manufacturing / Engineering | pending | ||
|
Ford Motor Company, S.A. de C.V. (Ford de Mexico) is the Mexican subsidiary of Ford Motor Company (USA), the first autom... |
||||||
| Ransomware | politur.gob.do id30027 View details | Dominican Republic | Public Sector | pending | ||
|
POLITUR (Dirección Central de Policía de Turismo / Central Directorate of Tourism Police), now also known as CESTUR (C... |
||||||
| Ransomware | sansilvestre.edu.pe id30019 View details | Peru | Education | pending | ||
|
San Silvestre School (Asociación Civil) is one of Peru's most prestigious private all-girls British schools, founded in... |
||||||
| Ransomware | aasa.ae id30006 View details | United Arab Emirates | Transportation / Travel / Logistics | pending | ||
|
AASA CP Holding Company (AASA Group) is a multinational business headquartered in Dubai, UAE, with a proud legacy of exc... |
||||||
| Ransomware | www.mupras.com id30007 View details | Brazil | Other | pending | ||
|
MUPRAS RAM (Mutuelle de Prévoyance et d'Actions Sociales de Royal Air Maroc) is a Moroccan mutual aid and social welfar... |
||||||
| Ransomware | coemi.com.br id30008 View details | Brazil | Manufacturing / Engineering | pending | ||
|
Coemi Imóveis is a Brazilian real estate company with 41 years of tradition in Brasília, Distrito Federal, Brazil, fou... |
||||||
| Ransomware | www.courdescomptes.sn id29963 View details | Senegal | Public Sector | pending | ||
|
La Cour des Comptes du Sénégal (The Court of Auditors of Senegal) is an independent supreme audit institution of Seneg... |
||||||
| Ransomware | ersa.com.py id29964 View details | Paraguay | Energy | pending | ||
|
ERSA (Enrique Remmele S.A.C.I.) is a 100% Paraguayan industrial company founded in 1928, originally established for the ... |
||||||
| Ransomware | theorangeblowfish.com id29892 View details | Retail / E-commerce | pending | |||
|
The Orangeblowfish is an award-winning independent creative and branding agency founded in 2012 by Natalie Lowe, headqua... |
||||||
| Ransomware | frey.com id29863 View details | Switzerland | Manufacturing / Engineering | pending | ||
|
FREY (Frey Brothers, Inc.) is an American eco-friendly laundry care products company founded in 2017 by brothers Erin an... |
||||||
| Ransomware | www.mbt-energy.com id29849 View details | Germany | Energy | pending | ||
|
Xiamen Mibet New Energy Co., Ltd. (Mibet Energy) is a Chinese high-tech enterprise specializing in the research, develop... |
||||||
| Ransomware | aisem.gob.bo id29820 View details | Bolivia, Plurinational State of | Public Sector | pending | ||
|
AISEM (Agencia de Infraestructura en Salud y Equipamiento Médico) is a Bolivian government agency responsible for the d... |
||||||
| Ransomware | www.progress-security.com id29821 View details | Germany | Services | pending | ||
|
Progress Security Systems is a leading UAE-based provider of enterprise-grade security solutions, headquartered in Abu D... |
||||||
| Ransomware | libertyinsurance.com.ph id29732 View details | Philippines | Finance / Legal / Insurance | pending | ||
|
Liberty Insurance Corporation is a Philippine non-life insurance company established in 1953, headquartered in Makati Ci... |
||||||
| Ransomware | PROBE, S.A. DE C.V id29733 View details | Mexico | Manufacturing / Engineering | pending | ||
|
***.A. DE C.V. is a Salvadoran family-owned company founded in 1978, headquartered in San Salvador, El Salvador. It... |
||||||
| Ransomware | huashan.com.cn id29657 View details | China | Manufacturing / Engineering | pending | ||
|
Shantou Huashan Electronic Devices Co., Ltd. (SHEDCL) is a Chinese manufacturer of semiconductor devices and electronic ... |
||||||
| Ransomware | schultz.com.br id29652 View details | Brazil | Retail / E-commerce | pending | ||
|
Schultz Operadora de Turismo helps people explore the world with easy travel planning. They handle everything from airli... |
||||||
| Ransomware | www.elumax.com id29582 View details | Taiwan, Province of China | Manufacturing / Engineering | pending | ||
|
Lumax is dedicated to maintaining high standards of ethics, corporate governance and effective accountability mechanisms... |
||||||
| Ransomware | activ88-interim.com id29565 View details | Germany | Finance / Legal / Insurance | pending | ||
|
Activ'Interim 88 was founded in 2008 with the aim of connecting job seekers with the best opportunities available in the... |
||||||
| Ransomware | www.transbras.com.gt id29566 View details | Guatemala | Transportation / Travel / Logistics | pending | ||
|
Founded in 1974, started its activities in Road Transport, eventually expanding its services to several other areas, fir... |
||||||
| Ransomware | tulipmediworld.com id29368 View details | India | Healthcare / Pharma | leaked | ||
|
A complete data breach has occurred at Tulip Mediworld Hospital, a multi-specialty hospital located on GS Road, Rukmini ... |
||||||
| Ransomware | ecci-srl.com id29387 View details | Italy | Construction / Real Estate | pending | ||
|
Empresa dedicada al rubro de construcción de proyectos inmobiliarios, particularmente la Ciudad Nueva Santa Cruz. El á... |
||||||
| Ransomware | motofrenos.com id29457 View details | Mexico | Manufacturing / Engineering | pending | ||
|
MotoFrenos is a Colombian metalworking company with a global reach that designs, manufactures, and installs equipment an... |
||||||
| Ransomware | smile-siam.com id29458 View details | Thailand | Other | pending | ||
|
Smile Siam Printing Service founded since 1995 by a group of experienced staff in printing business, we are the distinct... |
||||||
| Ransomware | ctps.tp.edu.tw id29496 View details | Taiwan, Province of China | Education | pending | ||
|
ctps.tp.edu.tw — Taiwanese Public Elementary School ctps.tp.edu.tw is the official website of 臺北市南港區成... |
||||||
| Ransomware | bangkok.go.th id29330 View details | Thailand | Public Sector | pending | ||
|
The Bangkok Metropolitan Administration (BMA) is the local government of Bangkok, which includes the capital of Thailand... |
||||||
| Ransomware | lasevillanita.com id29323 View details | Spain | Transportation / Travel / Logistics | pending | ||
|
Transportes La Sevillanita Srl is a company that operates in the Freight & Logistics Services industry. It employs 10to1... |
||||||
| Ransomware | SARL CANIS EVENTS SÉCURITÉ PRIVÉE id29265 View details | France | Other | pending | ||
|
SARL CANIS EVENTS SÉCURITÉ PRIVÉE is a company operating in the private security and guarding sector, with a focus on... |
||||||
| Ransomware | nacs.com.hk id29266 View details | Hong Kong | Services | pending | ||
|
nacs.com.hk is a Hong Kong-based corporate and administrative services company, specializing in company formation and ma... |
||||||
| Ransomware | mindmastersg.com id29267 View details | Singapore | Other | pending | ||
|
Mind Master offers an AI-native enterprise operations platform designed to govern execution and decision-making processe... |
||||||
| Ransomware | wwag.org id29175 View details | Austria | Other | pending | ||
|
An organization known as Wa Wai Assembly of God Church, an entity located in Hong Kong 🇭🇰 and operating under a na... |
||||||
| Ransomware | eclagestio360.com id29000 View details | Spain | Services | pending | ||
|
ECLAGESTIÓ A Spanish company specializing in comprehensive management for businesses and individuals, operating in the... |
||||||
| Ransomware | ovextech.com id28846 View details | United States | IT | pending | ||
|
Ovex Tech specializes in providing comprehensive BPO services and call center solutions, including inbound and outbound ... |
||||||
| Ransomware | foodsmart.com.do id28864 View details | Dominican Republic | Hospitality / Food & Beverage / Tourism | pending | ||
|
Foodsmart Dominicana, S.R.L A company operating in the food industry Specializing in flour derivative products (harina... |
||||||
| Ransomware | bomuhospital.org id28337 View details | Kenya | Healthcare / Pharma | pending | ||
|
Bomu Hospital is a social enterprise dedicated to providing access to quality healthcare for all individuals, regardless... |
||||||
| Ransomware | weiss-pm.de id28415 View details | Germany | Construction / Real Estate | pending | ||
|
WEISS PM: The ideal company for tailored recruitment solutions. For nearly 40 years, WEISS PM has been a trusted partner... |
||||||
| Ransomware | zsiclife.co.zm id28473 View details | Zambia | Finance / Legal / Insurance | pending | ||
|
ZSIC Life Plc is a leading assurance, savings, and wealth management company in Zambia, offering a diverse range of life... |
||||||
| Ransomware | moser-spiel.at id28506 View details | Austria | Manufacturing / Engineering | pending | ||
|
moser-spiel.at is an Austrian company specializing in the design and manufacture of outdoor play equipment and sports pa... |
||||||
| Ransomware | Narteks Tekstil A.S id28609 View details | Türkiye | Manufacturing / Engineering | pending | ||
|
Narteks Tekstil Sanayi ve Ticaret A.Ş., one of the well-known Turkish companies in the cotton yarn and textile industry... |
||||||
| Ransomware | imbriefamilylaw.com id28737 View details | United Kingdom | Finance / Legal / Insurance | pending | ||
|
The attorneys at the Imbrie Law Firm practice primarily in the following counties: Brazos, Robertson, Burleson, Lee, Gri... |
||||||
| Ransomware | rhode-hv.de id28283 View details | Germany | Construction / Real Estate | pending | ||
|
iseg Spezialelektronik GmbH is a German company specializing in high-voltage microelectronics (high-voltage electronics)... |
||||||
| Ransomware | putzbaer.berlin id28264 View details | Germany | Services | pending | ||
|
putzbär Gebäudemanagement GmbH is a building management company based in Berlin, specializing in a wide range of servi... |
||||||
| Ransomware | Hacked 0APT id28207 View details | IT | pending | |||
|
Next time, don't play with the big boys. The response will be fast.... |
||||||
| Ransomware | asesoriauriel.com id28198 View details | Mexico | Finance / Legal / Insurance | pending | ||
|
Asesoría Uriel is a consultancy and management firm located in Soria, specialized in providing services to individuals,... |
||||||
| Ransomware | unipest.co.th id28197 View details | Thailand | Services | pending | ||
|
Unipest Company Limited specializes in pest control services, including the elimination of termites, ants, cockroaches, ... |
||||||
| Ransomware | palladium.gen.tr id28196 View details | Türkiye | Manufacturing / Engineering | pending | ||
|
Palladium Teknoloji ve Mühendislik Ltd. Şti. is a private Turkish company operating in the field of industrial enginee... |
||||||
| Ransomware | secran.com.br id28195 View details | Brazil | Finance / Legal / Insurance | pending | ||
|
SECRAN Group is a trusted partner with over 40 years of experience, focusing on providing a comprehensive portfolio of b... |
||||||
| Ransomware | Some 0APT false claims id28194 View details | Other | pending | |||
|
We apologize for this data leak, but it did not affect our operations. The error was in the server settings; the phpMyAd... |
||||||
| Ransomware | dencom.co.nz id28089 View details | New Zealand | Telecommunications | pending | ||
|
Dencom New Zealand Limited has been delivering IT support and solutions for over 30 years, catering to a diverse range o... |
||||||
| Ransomware | conrepsa.ro id28075 View details | Romania | Construction / Real Estate | pending | ||
|
CONREP SA is a Romanian construction, contracting, and infrastructure company, considered one of the most experienced in... |
||||||
| Ransomware | megasurf.co.za id28050 View details | South Africa | Telecommunications | pending | ||
|
Megasurf is an internet service provider and data center operator specializing in high-speed fibre and wireless internet... |
||||||
| Ransomware | Gerald Zisser GmbH id27964 View details | Germany | Transportation / Travel / Logistics | pending | ||
|
Gerald Zisser GmbH is a private Austrian company specializing in building technical services, focusing on plumbing, heat... |
||||||
| Ransomware | fraper.com id27943 View details | Spain | IT | pending | ||
|
Comercial Fraper S.L. is a privately held Spanish company specializing in building materials, tools, and household suppl... |
||||||
| Ransomware | CCCKeito.edu.hk id27924 View details | Hong Kong | Education | pending | ||
|
CCC Kei To Secondary School (中華基督教會基道中學) CCCKeito.edu.hk is the official website of this secondary ... |
||||||
| Ransomware | lkc.ac.bw id27885 View details | Botswana | Education | pending | ||
|
Livingstone Kolobeng College (LKC) is a private educational institution located in Gaborone, the capital of Botswana . I... |
||||||
| Ransomware | BJ Grupo id27876 View details | Mexico | Transportation / Travel / Logistics | pending | ||
|
BJ Grupo operates in the fuel and lubricating oil distribution sector throughout the state of São Paulo. The company of... |
||||||
| Ransomware | kramer-nsc.at id27875 View details | Austria | IT | pending | ||
|
Kramer Nutzfahrzeug Service Center GmbH specializes in the service and repair of commercial vehicles, including brands l... |
||||||
| Ransomware | whiskey.co.jp id27874 View details | Japan | IT | pending | ||
|
Whiskey & Co., Inc. (in Japanese: Whiskey & Co.株式会社) is a modern Japanese company founded on January 28, 2021. I... |
||||||