krybit
First seen April 3, 2026Active135 claimed victims
The claims below are reproduced as posted by krybit on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Krybit is an emerging RaaS group that launched in late March 2026, offering affiliates an 80/20 revenue split with support for Windows, Linux, ESXi, and NAS device encryption, and became notable for a public feud with rival group 0APT in which each breached and leaked the other's operator data.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| bangkok.go.th | May 23, 2026 | ransomware_live | — |
| ctps.tp.edu.tw | May 23, 2026 | ransomware_live | — |
| mindmastersg.com | May 19, 2026 | ransomware_live | — |
| nacs.com.hk | May 19, 2026 | ransomware_live | — |
| SARL CANIS EVENTS SÉCURITÉ PRIVÉE | May 19, 2026 | ransomware_live | — |
| lasevillanita.com | May 18, 2026 | ransomware_live | — |
| wwag.org | May 15, 2026 | ransomware_live | — |
| eclagestio360.com | May 9, 2026 | ransomware_live | — |
| foodsmart.com.do | May 5, 2026 | ransomware_live | — |
| ovextech.com | May 4, 2026 | ransomware_live | — |
| tulipmediworld.com | May 1, 2026 | ransomware_live | — |
| weiss-pm.de | April 30, 2026 | ransomware_live | — |
| bomuhospital.org | April 30, 2026 | ransomware_live | — |
| Narteks Tekstil A.S | April 27, 2026 | ransomware_live | — |
| zsiclife.co.zm | April 26, 2026 | ransomware_live | — |
| moser-spiel.at | April 25, 2026 | ransomware_live | — |
| imbriefamilylaw.com | April 17, 2026 | ransomware_live | — |
| rhode-hv.de | April 16, 2026 | ransomware_live | — |
| putzbaer.berlin | April 15, 2026 | ransomware_live | — |
| Some 0APT false claims | April 14, 2026 | ransomware_live | — |
| secran.com.br | April 14, 2026 | ransomware_live | — |
| palladium.gen.tr | April 14, 2026 | ransomware_live | — |
| unipest.co.th | April 14, 2026 | ransomware_live | — |
| asesoriauriel.com | April 14, 2026 | ransomware_live | — |
| Hacked 0APT | April 14, 2026 | ransomware_live | — |
| dencom.co.nz | April 11, 2026 | ransomware_live | — |
| conrepsa.ro | April 10, 2026 | ransomware_live | — |
| Gerald Zisser GmbH | April 8, 2026 | ransomware_live | — |
| megasurf.co.za | April 8, 2026 | ransomware_live | — |
| CCCKeito.edu.hk | April 4, 2026 | ransomware_live | — |
| BJ Grupo | April 3, 2026 | ransomware_live | — |
| lkc.ac.bw | April 3, 2026 | ransomware_live | — |
| fraper.com | April 3, 2026 | ransomware_live | — |
| whiskey.co.jp | March 31, 2026 | ransomware_live | — |
| kramer-nsc.at | March 30, 2026 | ransomware_live | — |
← NewerPage 2 of 2
Claim data from ransomware.live and RansomLook (CC BY 4.0).