Threadlinqs IntelligenceStart free

Threat actorTracked since 2026-05

KryBit

Also known as:KryBit RaaSKryBit Ransomware

As of 2026-07-13, KryBit is a threat actor tracked by Threadlinqs Intelligence across 2 threats spanning ransomware. Also known as KryBit RaaS, KryBit Ransomware. ATT&CK coverage spans 46 techniques across 15 tactics in 2 of 2 tracked threats. Most-observed techniques: T1021.001 (Remote Desktop Protocol), T1041 (Exfiltration Over C2 Channel), T1071 (Application Layer Protocol).

Tracked threats
22 high
First seen
2026-05-13
Last seen
2026-07-13
ATT&CK techniques
46across 2 of 2 threats
Related CVEs
1Referenced by its activity
2 tracked threat(s) · Categories: RANSOMWARE

Activity timeline

KryBit appears in 2 tracked threats between and ; the busiest month was 2026-05 with 1 report.

ATT&CK techniques observed

46 techniques observed across 2 of 2 tracked threats · Execution (5), Impact (5), Command and Control (4), Discovery (4), Initial Access (4), Persistence (4)
  • T1021.001 Remote Desktop Protocol — Lateral Movementobserved in 2 of 2 tracked threats
  • T1041 Exfiltration Over C2 Channel — Exfiltrationobserved in 2 of 2 tracked threats
  • T1071 Application Layer Protocol — Command and Controlobserved in 2 of 2 tracked threats
  • T1078 Valid Accounts — Initial Accessobserved in 2 of 2 tracked threats
  • T1486 Data Encrypted for Impact — Impactobserved in 2 of 2 tracked threats
  • T1490 Inhibit System Recovery — Impactobserved in 2 of 2 tracked threats
  • T1567 Exfiltration Over Web Service — Exfiltrationobserved in 2 of 2 tracked threats
  • T1573 Encrypted Channel — Command and Controlobserved in 2 of 2 tracked threats
  • T1685 Disable or Modify Tools — Defense Impairmentobserved in 2 of 2 tracked threats
  • T1003.001 LSASS Memory — Credential Accessobserved in 1 of 2 tracked threats
  • T1005 Data from Local System — Collectionobserved in 1 of 2 tracked threats
  • T1018 Remote System Discovery — Discoveryobserved in 1 of 2 tracked threats
  • T1021 Remote Services — Lateral Movementobserved in 1 of 2 tracked threats
  • T1021.004 SSH — Lateral Movementobserved in 1 of 2 tracked threats
  • T1027 Obfuscated Files or Information — Stealth (formerly Defense Evasion)observed in 1 of 2 tracked threats

Tracked threats

Related CVEs

1 CVE referenced by tracked KryBit activity