Loading threat actor…
Krybit is a newly active ransomware and cyber-extortion group that emerged in 2026 and operates a leak-site style public shaming model. The group has been identified in multiple ransomware victim listings and industry tracking reports as an emerging actor in the broader ransomware ecosystem. Public reporting indicates Krybit targets organizations outside the United States more often than the ecosystem average and has claimed victims across Europe, Asia, Africa, and Latin America. Observed victimology includes organizations in professional services, health care, education, industrial and manufacturing-related businesses, marine logistics, real estate-related operations, and other commercial sectors. Reported victim countries include France, Italy, India, Taiwan, Singapore, Finland, Argentina, South Africa, and Brazil, among others. Germany has also been cited as a country significantly exposed to ransomware and extortion activity involving newcomers such as Krybit. Krybit is associated with ransomware attack claims and leak-page postings consistent with data-theft extortion operations. However, some listings attributed to the group have been explicitly flagged by researchers and trackers as unverified or potentially fabricated, and certain claimed victims lack corroborating evidence such as leaked files, screenshots, or detailed proof of compromise. As a result, individual victim claims should be treated cautiously unless independently confirmed. High-confidence reporting supports Krybit's role as a ransomware/extortion actor using public victim claims and breach disclosures as pressure mechanisms. Available evidence supports exfiltration-related extortion claims and ransomware activity, but does not provide reliable detail on the group's malware lineage, affiliate structure, initial access methods, or country of origin.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
15 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 CVE this actor has used in observed campaigns. 1 of them exploited in the wild.
21 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A newly active ransomware group cited as one of the quarter’s fastest-growing actors and noted for targeting the US less often than average.
A newly active ransomware group identified as one of the quarter’s fastest-growing operators and noted for targeting the US less often than the ecosystem average.
Conducting a ransomware attack against LHYK Marine Pte Ltd (lhyk.com.sg) in Singapore.
Conducting a ransomware attack against labindia.com / Labindia Instruments Pvt. Ltd.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.