Cyber Incident Victim: KryBit
Date:
Apr 2026
Location:
—
Summary
The ransomware‑as‑a‑service group KryBit, which offers kits for Windows, Linux, ESXi and NAS devices, was targeted by rival 0APT, which claimed to have breached its infrastructure and leaked details on two administrators, five affiliates, roughly twenty potential victims and ransom demands between $40,000 and $100,000. In response, it infiltrated the rival’s systems, exposed access logs, PHP source code and other operational files, listed the rival as a victim on its leak site and left a taunting message, while the rival’s earlier victim list was later shown to be fabricated.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 3 motives | 2 techniques |
| Threat Actors | Type | Location |
|---|---|---|
| 2 actors | Available to members | Available to members |
Description
0APT emerged in late January 2026 and posted a list of nearly 200 victims to its data leak blog over the course of a week. The list was widely regarded as fabricated due to a lack of evidence of actual compromises, although Halcyon assessed that 0APT used functioning encryptors. After the initial posting, 0APT went quiet for several months. KryBit emerged in late March 2026, offering ransomware‑as‑a‑service kits that targeted Windows, Linux, ESXi and network‑attached storage devices under an 80/20 affiliate model and published ten legitimate victims in its first two weeks.
In mid‑April 2026, 0APT deleted its previous victim list and claimed to have launched ransomware attacks against ransomware operators, naming KryBit, Everest and RansomHouse as targets. Responding to the claim, KryBit breached 0APT’s infrastructure, exfiltrated operational data including access logs, PHP source code and system files, and listed 0APT as a victim on its own leak site. KryBit left a message on the defaced 0APT leak site stating “Next time, don't play with the big boys.” The exposure revealed two administrators, five affiliates, twenty potential victims associated with KryBit and showed ransom demands ranging from forty thousand to one hundred thousand dollars.
0APT has been unable to recover from the leak and its leak site remains defaced by KryBit. KryBit retained access to the exfiltrated 0APT data and continued to display the compromised information. The feud provided defenders with rare insight into the internal operations of both ransomware‑as‑a‑service groups.