0APT

0APT is a ransomware-branded cybercrime operation that emerged in late January 2026 and presented itself as a ransomware-as-a-service (RaaS) program under aliases including 0apt and 0apt_team. The group rapidly claimed more than 200 victims within days of launch, but multiple independent investigations found those claims were largely fabricated or unsubstantiated. Reported anomalies included fictional victim names, implausible proof artifacts, corrupted or meaningless sample data, absence of corroborating ransom notes or victim communications in many cases, and indications that the operation may have been designed in part to defraud prospective affiliates or extort organizations through fear rather than through demonstrated network compromise. Some reporting also assessed that 0APT solicited affiliates and may have sought to obtain valuable exploit capability from would-be partners. Despite the credibility problems around its victim claims, 0APT maintained operational ransomware infrastructure, including a leak site, negotiation mechanisms, and an affiliate panel. Researchers reported that its ransomware samples for Windows and Linux were functional, and separate malware reporting described a Rust-based encryptor commonly referred to as 0APT Locker that appends a distinctive extension to encrypted files and uses a ransom note threatening data leakage, regulator notification, and outreach to clients or partners. Public reporting also indicates the panel supported cross-platform payload generation, including Windows, Linux, and macOS variants, reinforcing that the group possessed at least some real malware-development capability even if its public victim narrative was deceptive. 0APT engaged in criminal-on-criminal activity as well as victim-facing extortion. In April 2026 it breached rival RaaS operation Krybit’s affiliate panel, leaked internal data, and threatened to expose Krybit affiliates unless paid. Krybit subsequently retaliated by compromising 0APT infrastructure, defacing its leak site, and publishing 0APT operational data. Reporting based on the exposed material stated that 0APT had fabricated many of its earlier victim claims. This conflict made 0APT notable within the 2026 ransomware ecosystem as an example of ransomware-on-ransomware disruption. Available reporting consistently characterizes 0APT’s dominant motive as financial. Its observed behavior includes extortion, data-leak threats, affiliate recruitment, and likely fraud directed at both organizations and other cybercriminals. Publicly claimed targeting was broad and opportunistic, with emphasis in reporting on health care, professional services, technology, transportation and logistics, energy, manufacturing, and other data-rich or critical-infrastructure-adjacent sectors. Most claimed victims were reported to be in the United States, but many of those claims remain unverified. No high-confidence attribution to a nation-state or a specific country of origin is currently available.