MalwareUsed by 1 actor

Krybit

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

0APT

Krybit is a RaaS operation first observed in the wild in late March 2026... The group targets organizations for financial gain through a double-extortion model, exfiltrating sensitive data before encrypting victim systems.

via malware newsmalware.news

MITRE ATT&CK

Techniques & procedures

12 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1078Valid AccountsEvidence1

Tracked ATT&CK activity includes Valid Accounts (T1078) and Remote Services (T1021/T1021.001), pointing to compromised credentials and Remote Desktop Protocol (RDP) as common entry points

Execution

1 technique

T1059Command and Scripting InterpreterEvidence1

Tracked activity includes Command and Scripting Interpreter (T1059), pointing to script-based execution, though the specific interpreter has not been confirmed in public reporting.

Persistence

3 techniques

T1037Boot or Logon Initialization ScriptsEvidence1

Persistence is tagged via Boot or Logon Autostart Execution (T1547) and Boot or Logon Initialization Scripts (T1037).

T1078Valid AccountsEvidence1

Tracked ATT&CK activity includes Valid Accounts (T1078) and Remote Services (T1021/T1021.001), pointing to compromised credentials and Remote Desktop Protocol (RDP) as common entry points

T1547Boot or Logon Autostart ExecutionEvidence1

Persistence is tagged via Boot or Logon Autostart Execution (T1547) and Boot or Logon Initialization Scripts (T1037).

Privilege Escalation

3 techniques

T1037Boot or Logon Initialization ScriptsEvidence1

Persistence is tagged via Boot or Logon Autostart Execution (T1547) and Boot or Logon Initialization Scripts (T1037).

T1078Valid AccountsEvidence1

Tracked ATT&CK activity includes Valid Accounts (T1078) and Remote Services (T1021/T1021.001), pointing to compromised credentials and Remote Desktop Protocol (RDP) as common entry points

T1547Boot or Logon Autostart ExecutionEvidence1

Persistence is tagged via Boot or Logon Autostart Execution (T1547) and Boot or Logon Initialization Scripts (T1037).

Stealth

1 technique

T1078Valid AccountsEvidence1

Tracked ATT&CK activity includes Valid Accounts (T1078) and Remote Services (T1021/T1021.001), pointing to compromised credentials and Remote Desktop Protocol (RDP) as common entry points

Lateral Movement

2 techniques

T1021Remote ServicesEvidence1

Tracked ATT&CK activity includes Valid Accounts (T1078) and Remote Services (T1021/T1021.001), pointing to compromised credentials and Remote Desktop Protocol (RDP) as common entry points

T1021.001Remote Desktop ProtocolEvidence1

Tracked ATT&CK activity includes Valid Accounts (T1078) and Remote Services (T1021/T1021.001), pointing to compromised credentials and Remote Desktop Protocol (RDP) as common entry points

Command and Control

2 techniques

T1071Application Layer ProtocolEvidence1

Victim communication and leak-site activity route through Tor hidden services, tagged as Application Layer Protocol (T1071) and Ingress Tool Transfer (T1105), anonymizing the group’s infrastructure.

T1105Ingress Tool TransferEvidence1

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

Exfiltration is tagged as Exfiltration Over C2 Channel (T1041), with 10–250GB of staged data per victim documented in the leaked affiliate panel.

Impact

2 techniques

T1486Data Encrypted for ImpactEvidence1

The final payload appends the .KRYBIT extension to encrypted files (mapped to Data Encrypted for Impact, T1486) and drops a ransom note named RECOVER-README.txt

T1490Inhibit System RecoveryEvidence1

Prior to encryption, Krybit executes vssadmin.exe delete shadows /all /quiet to delete Volume Shadow Copies, disabling built-in Windows recovery (mapped to Inhibit System Recovery, T1490).

Other

1 technique

T1562Impair DefensesEvidence1

Researcher analysis describes defense evasion through obfuscation, process injection, and abuse of legitimate system processes, mapping to Impair Defenses (T1562).

INDICATORS OF COMPROMISE

IOCs tracked for this family

14 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

14 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in apptoday

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

malware newsNews

Jul 13, 2026

Dark Web Profile: Krybit Ransomware - Malware News - Malware Analysis, News and Indicators

A ransomware-as-a-service operation using double extortion. It exfiltrates victim data, encrypts systems, appends the .KRYBIT extension to files, drops a ransom note named RECOVER-README.txt, and uses a Tor-based leak/negotiation site.

socradar blogNews

Jul 13, 2026

Dark Web Profile: Krybit Ransomware

A financially motivated ransomware-as-a-service operation using double extortion. It encrypts victim systems, appends the .KRYBIT extension, drops a ransom note named RECOVER-README.txt, uses Tor-based negotiation and leak infrastructure, and targets organizations opportunistically via affiliates.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching14

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping12

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareUsed by 1 actor

Krybit

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

0APT

via malware newsmalware.news

MITRE ATT&CK

Techniques & procedures

12 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1078Valid AccountsEvidence1

Tracked ATT&CK activity includes Valid Accounts (T1078) and Remote Services (T1021/T1021.001), pointing to compromised credentials and Remote Desktop Protocol (RDP) as common entry points

Execution

1 technique

T1059Command and Scripting InterpreterEvidence1

Tracked activity includes Command and Scripting Interpreter (T1059), pointing to script-based execution, though the specific interpreter has not been confirmed in public reporting.

Persistence

3 techniques

T1037Boot or Logon Initialization ScriptsEvidence1

Persistence is tagged via Boot or Logon Autostart Execution (T1547) and Boot or Logon Initialization Scripts (T1037).

T1078Valid AccountsEvidence1

Tracked ATT&CK activity includes Valid Accounts (T1078) and Remote Services (T1021/T1021.001), pointing to compromised credentials and Remote Desktop Protocol (RDP) as common entry points

T1547Boot or Logon Autostart ExecutionEvidence1

Persistence is tagged via Boot or Logon Autostart Execution (T1547) and Boot or Logon Initialization Scripts (T1037).

Privilege Escalation

3 techniques

T1037Boot or Logon Initialization ScriptsEvidence1

Persistence is tagged via Boot or Logon Autostart Execution (T1547) and Boot or Logon Initialization Scripts (T1037).

T1078Valid AccountsEvidence1

Tracked ATT&CK activity includes Valid Accounts (T1078) and Remote Services (T1021/T1021.001), pointing to compromised credentials and Remote Desktop Protocol (RDP) as common entry points

T1547Boot or Logon Autostart ExecutionEvidence1

Persistence is tagged via Boot or Logon Autostart Execution (T1547) and Boot or Logon Initialization Scripts (T1037).

Stealth

1 technique

T1078Valid AccountsEvidence1

Tracked ATT&CK activity includes Valid Accounts (T1078) and Remote Services (T1021/T1021.001), pointing to compromised credentials and Remote Desktop Protocol (RDP) as common entry points

Lateral Movement

2 techniques

T1021Remote ServicesEvidence1

Tracked ATT&CK activity includes Valid Accounts (T1078) and Remote Services (T1021/T1021.001), pointing to compromised credentials and Remote Desktop Protocol (RDP) as common entry points

T1021.001Remote Desktop ProtocolEvidence1

Tracked ATT&CK activity includes Valid Accounts (T1078) and Remote Services (T1021/T1021.001), pointing to compromised credentials and Remote Desktop Protocol (RDP) as common entry points

Command and Control

2 techniques

T1071Application Layer ProtocolEvidence1

T1105Ingress Tool TransferEvidence1

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

Exfiltration is tagged as Exfiltration Over C2 Channel (T1041), with 10–250GB of staged data per victim documented in the leaked affiliate panel.

Impact

2 techniques

T1486Data Encrypted for ImpactEvidence1

The final payload appends the .KRYBIT extension to encrypted files (mapped to Data Encrypted for Impact, T1486) and drops a ransom note named RECOVER-README.txt

T1490Inhibit System RecoveryEvidence1

Prior to encryption, Krybit executes vssadmin.exe delete shadows /all /quiet to delete Volume Shadow Copies, disabling built-in Windows recovery (mapped to Inhibit System Recovery, T1490).

Other

1 technique

T1562Impair DefensesEvidence1

Researcher analysis describes defense evasion through obfuscation, process injection, and abuse of legitimate system processes, mapping to Impair Defenses (T1562).

INDICATORS OF COMPROMISE

IOCs tracked for this family

14 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

14 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in apptoday

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

malware newsNews

Jul 13, 2026

Dark Web Profile: Krybit Ransomware - Malware News - Malware Analysis, News and Indicators

socradar blogNews

Jul 13, 2026

Dark Web Profile: Krybit Ransomware

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching14

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping12

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.