# Krybit Ransomware — Babuk-Derived RaaS Operation Emerges with Double Extortion

> Krybit is a financially motivated ransomware-as-a-service (RaaS) operation first observed in late March 2026, built on Babuk's leaked 2021 source code. It uses double extortion — exfiltrating 10-250GB of victim data before cross-platform encryption of Windows, Linux, VMware ESXi, and NAS environments — and pressures payment via a Tor-based leak site, targeting Professional Services, Technology, and Manufacturing sectors across 43 countries.

- **Published:** 2026-07-13T00:00:00Z
- **Last reviewed:** 2026-07-13T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1263
- **ID:** TL-2026-1263
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** KryBit
- **Detections:** 9 · **IOCs:** 18 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Krybit emerged as a Babuk-derived ransomware-as-a-service operation with earliest confirmed operational activity dated to March 28, 2026 in affiliate panel records, and first underground detection on April 3, 2026. Rather than custom-engineered malware, Krybit's encryptor is built directly on the September 2021 Babuk source code leak — the same leak that spawned at least nine other ransomware families (Play, Mario, Conti POC, REvil/Revix, Cylance, Dataf Locker, Rorschach/BabLock, Lock4, RTM Locker) targeting VMware ESXi. Antivirus engines flag Krybit samples as Babuk variants: Filecoder.Babyk.A (ESET), Babuk!ic (Microsoft), Ransom.Babuk (Combo Cleaner). Inheriting Babuk's architecture, Krybit's encryptor supports Windows, Linux (ELF), VMware ESXi hypervisors, and Network Attached Storage (NAS) devices, using the same elliptic-curve cryptography (ECC) key exchange combined with the Sosemanuk stream cipher characteristic of the original Babuk codebase. Encrypted files are appended with the `.KRYBIT` extension, and a ransom note named `RECOVER-README.txt` is dropped in affected directories. The malware deletes Volume Shadow Copies via `vssadmin.exe delete shadows /all /quiet` to inhibit system recovery (T1490) before encryption (T1486).

Krybit operates a classic RaaS affiliate model with an 80/20 revenue split favoring affiliates. At the time of an April 2026 panel breach, the operation comprised 2 administrators (handles KRYBIT and GREP), 5 affiliates (fsociety, M*A*R*S, D9D938D9AC9, 464D03CA2AF05, 753766EFA0462B), and 20 active victim negotiations. Ransom demands range $40,000-$100,000 per victim, with data staging of 10-250GB prior to encryption. As of the breach, zero ransom payments had been confirmed across five tracked Bitcoin wallets, all showing no transaction history. The affiliate panel exhibited severe operational security failures: plaintext (unhashed, unsalted) storage of both operator/affiliate passwords and victim negotiation communications.

The operation gained wider notoriety through an April 2026 turf war with rival RaaS operator 0APT. On April 12-13, 2026, 0APT breached Krybit's affiliate panel and published the leaked credentials and wallet data on its own leak site, listing Krybit as its first named target and threatening to expose operator identities unless paid. Krybit retaliated within 48 hours (April 14-15, 2026), compromising 0APT's server infrastructure, defacing 0APT's Tor leak site, and publishing 0APT's source code, bash history, nginx logs, and system files. Krybit posted 0APT itself as "victim #1" with the taunt "HACKED BY KRYBIT — Next time, don't play with the big boys." The counter-breach revealed that 0APT's entire data-leak operation had run on an Android phone using AnLinux-Parrot (Parrot OS via Android's Linux compatibility layer), serving content from /sdcard/ through an Nginx-on-port-8080 → PHP 8.2-FPM → Tor hidden service stack, and that the 190+ victims 0APT claimed in January 2026 were entirely fabricated with no actual data exfiltration. Despite the reputational fallout of having its own infrastructure exposed, Krybit has shown no sign of slowing, with new victim claims continuing to appear weekly through June-July 2026, and now maintains 70+ attributed victims and five active Tor leak-site mirrors.

Victimology skews toward Professional Services (21.4%), Technology (17.1%), and Manufacturing (14.3%), with Healthcare, Government, and Education comprising the remainder, spread across 43 countries — led by Germany (10.0%), and Spain and Brazil (7.1% each). No CVE or specific initial-access exploit has been publicly attributed to Krybit; affiliates appear to use varying entry methods consistent with valid-account abuse and remote services (RDP) common to Babuk-lineage affiliates, rather than a single signature vulnerability.

## MITRE ATT&CK

- T1078 Valid Accounts
- T1021 Remote Services
- T1021.001 Remote Desktop Protocol
- T1059 Command and Scripting Interpreter
- T1547 Boot or Logon Autostart Execution
- T1037 Boot or Logon Initialization Scripts
- T1685 Disable or Modify Tools
- T1021 Remote Services
- T1021.001 Remote Desktop Protocol
- T1105 Ingress Tool Transfer
- T1071 Application Layer Protocol
- T1573 Encrypted Channel
- T1041 Exfiltration Over C2 Channel
- T1567 Exfiltration Over Web Service
- T1490 Inhibit System Recovery
- T1486 Data Encrypted for Impact

## Sources

- [Dark Web Profile: Krybit Ransomware](https://socradar.io/blog/dark-web-profile-krybit-ransomware/)
- [KryBit Threat Group Profile](https://www.halcyon.ai/threat-group/krybit)
- [CTI Report: Krybit Ransomware — Panel Breach by 0APT](https://barricadecyber.com/threat-intelligence-report-krybit-ransomware-panel-breach-by-0apt/)
- [Ransomware Turf War as 0APT and KryBit Groups Trade Blows](https://www.infosecurity-magazine.com/news/ransomware-turf-war-0apt-krybit/)
- [Ransomware Infrastructure Exposed](https://cipherssecurity.com/ransomware-infrastructure-exposure-0apt-krybit/)
- [Feuding Ransomware Groups Leak Each Other's Data](https://www.darkreading.com/threat-intelligence/feuding-ransomware-groups-leak-data)
- [0APT Hacked - And Then Got Hacked Back](https://ransom-isac.com/blog/0apt-hacked-back/)
- [Ransomware groups hack each other, exposing false victim claims](https://www.paubox.com/blog/ransomware-groups-hack-each-other-exposing-fake-victim-claims)
- [Hypervisor Ransomware | Multiple Threat Actor Groups Hop on Leaked Babuk Code to Build ESXi Lockers](https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/)
- [Babuk code used by 9 ransomware gangs to encrypt VMWare ESXi servers](https://www.bleepingcomputer.com/news/security/babuk-code-used-by-9-ransomware-gangs-to-encrypt-vmware-esxi-servers/)
- [A ransomware source code leak spawned at least 10 'Babuk' imitators, researchers say](https://therecord.media/babuk-source-code-leak-leads-to-new-ransomware-variants)
- [Babuk ransomware's full source code leaked on hacker forum](https://www.bleepingcomputer.com/news/security/babuk-ransomwares-full-source-code-leaked-on-hacker-forum/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1263