Loading story…
SentinelOne reported on Kryptina, a ransomware-as-a-service operation that evolved from a previously discarded or "unsellable" codebase into a more mature threat aimed at enterprise victims. The reporting indicates the group repositioned the malware into a viable criminal offering, reflecting how threat actors can repurpose abandoned tooling into a service model capable of supporting broader intrusion and extortion activity.
The case highlights a familiar pattern in the ransomware ecosystem: recycled malware development, commercialization through the RaaS model, and a shift toward higher-value organizational targets. For defenders, the development underscores the need to track not only established ransomware families but also reworked variants and newly branded operations that may inherit capabilities, tradecraft, or weaknesses from earlier malware lineages.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
SentinelOne Labs published a report examining Kryptina RaaS, describing its progression from an earlier cast-off malware codebase into enterprise-focused ransomware. No additional dated incident details are provided in the reference content.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Krybit has emerged as a ransomware-as-a-service (**RaaS**) operation using **double extortion**, Tor-hosted leak infrastructure, and a likely **Babuk-derived** payload targeting **Windows, Linux, VMware ESXi, and NAS** environments. Reporting indicates the malware deletes shadow copies, appends the `.KRYBIT` extension to encrypted files, and drops a `RECOVER-README.txt` ransom note. The group has pursued broad, opportunistic victimization across **43 countries**, with **Germany, Spain, and Brazil** among the most affected geographies and professional services, technology, and manufacturing among the most targeted sectors. Public visibility into Krybit increased after rival RaaS operator **0APT** breached Krybit’s affiliate panel in April, exposing plaintext credentials, user roles, negotiation data, Tox IDs, and Bitcoin wallets, with leaked records showing about **20 victims** in active negotiations and ransom demands ranging from **$40,000 to $100,000**. Krybit retaliated by compromising and defacing 0APT’s leak site and publishing its operational data, creating a notable ransomware-on-ransomware conflict. Despite the reputational damage and evidence that no confirmed ransom payment had yet been recorded during the leaked period, Krybit continued naming victims through mid-2026 and showed no public signs of shutting down or rebranding.
Jul 13, 2026
Ransomware groups are increasingly operating like structured criminal businesses, outsourcing key functions to specialists and launching formal affiliate programs across underground forums. Researchers and reporting describe growing demand for **initial access brokers** and dedicated **negotiators** who handle ransom talks, pressure tactics, and extortion messaging, while forums such as **RAMP** emerged to support ransomware recruitment after other Russian-speaking sites restricted such advertising. New and revived operations have continued to market themselves aggressively, including **Eclipse Ransomware** with a managed affiliate model, Tor-based negotiation portals, leak-site support, and revenue-sharing terms, as well as earlier examples such as REvil-linked infrastructure reappearing to recruit affiliates and Maze partnering with other gangs through shared leak platforms.
Aug 15, 2026
Reporting highlights a broader shift in the ransomware ecosystem toward **platform-like operations** and **ransomware-as-a-service (RaaS)** models that lower the barrier to entry and accelerate the creation of new crews. Huntress telemetry for 2025 is cited as placing **Akira** as a leading ransomware group, with operators increasingly targeting the **hypervisor layer** to bypass traditional endpoint controls; separate commentary describes rapid victim growth for **Qilin** (claimed to exceed 1,000 victims in 2025) and notes **LockBit** regaining operational capability after prior disruption. The same reporting also points to “**Extortion-as-a-Service**” offerings (including a federation described as **SLSH**—Scattered Spider/Lapsus$/ShinyHunters) that enable affiliates to rent tooling rather than develop it, contributing to a surge in newly formed groups. A separate technical write-up details **Termite** ransomware as a Babuk-derived operation first observed in late 2024 that has matured into a multi-stage intrusion and **double-extortion** threat, claiming dozens of victims across multiple sectors and regions by March 2026. The report emphasizes Termite’s operationalization of **ClickFix** (browser-based social engineering) to bypass traditional phishing defenses, and provides a distinctive forensic marker: encrypted files reportedly have the Babuk-inherited trailing string `"choung dong looks like hot dog"`, positioned as a practical indicator during triage. Another overview article catalogs major active ransomware groups and tactics, including **Lynx** (described as sharing substantial code with INC, using double extortion, appending `.lynx`, and deleting shadow copies) and **Medusa**, while reiterating law-enforcement attribution and indictments tied to **LockBit** leadership and deployment activity.
Jun 29, 2026