Loading story…
Researchers assessed a purported ransomware operation calling itself 0APT and found indicators it may be a scam rather than an active extortion group. The actor launched a data-leak site in late January and rapidly posted 200+ claimed victims within about a week—an unusually high tempo that often suggests a rebrand or splinter group, prompting closer scrutiny by GuidePoint Security.
Reporting indicates the 0APT narrative quickly unraveled after online observers flagged that many listed victims appeared fake (potentially AI-generated names). The group then took its leak site offline, later relaunching it with a smaller list of real organizations, but researchers said none of the alleged compromises have been substantiated; in at least two cases, organizations that conducted incident response investigations reportedly found no evidence of a breach. The operation also reportedly required a bitcoin “joining fee” for affiliates, reinforcing concerns that the brand is being used to monetize would-be partners rather than to conduct verified ransomware intrusions.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
9 events from the most recent confirmed update back to the earliest known activity.
By 2026-04-30, reporting citing Halcyon said KryBit had compromised rival group 0APT and published extensive internal data in response to 0APT's earlier exposure of KryBit materials. The leaked data reportedly included 0APT access logs, system files, and PHP source code, while also revealing operational weaknesses in 0APT's leak-site infrastructure.
By 2026-04-15, 0APT had reportedly leaked selected data it claimed was stolen from the Krybit ransomware gang and threatened to expose Krybit affiliates unless the group negotiated or paid. Analysis of the leaked files reportedly found plaintext credentials for Krybit operators and affiliates and five cryptocurrency wallet addresses, while Krybit's website was experiencing outages.
On February 10-11, 2026, reporting citing GuidePoint Security, Kela, Bitdefender, and others concluded that 0APT was likely a scam or large-scale hoax aimed at defrauding cybercriminals and building false credibility. Some researchers cautioned that, despite the fake claims, the actors could still evolve into a real ransomware threat.
At least two organizations named by 0APT conducted incident response assessments and found no evidence of intrusion or data theft. These findings further undermined the group's extortion and leak claims.
0APT later brought its leak site back online with a much smaller set of named organizations after previously listing more than 200 victims. Researchers said the remaining organizations still had not been validated as genuinely breached.
After reports that many listed victims appeared fake, potentially including AI-generated entries, 0APT took its leak site offline. The outage followed scrutiny over the implausible scale and quality of its claimed victim disclosures.
By early February 2026, multiple security firms reported that 0APT's alleged victim data, leak-site file trees, and proof-of-compromise materials did not credibly support its claims. Analysts also noted no observed ransom notes, no decryptor demonstrations, and other inconsistencies that pointed to a hoax or inflated operation.
As the group emerged in late January 2026, 0APT advertised a ransomware-as-a-service affiliate program, including a 1 bitcoin joining or assessment fee. Researchers said its explicit request for applicants to demonstrate zero-day exploits suggested a predatory effort to steal valuable tools from would-be partners.
In late January 2026, a previously unknown group calling itself 0APT launched a data-leak site and rapidly began listing large numbers of purported victims. Early claims ranged from more than 90 to roughly 200 organizations within days.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcescworld.com
Open sourcecyberscoop.com
Open sourcebankinfosecurity.com
Open sourcegovinfosecurity.com
Open sourcebitdefender.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A new ransomware operation calling itself **0APT** surfaced on dark web infrastructure in early 2026, promoting itself as a *ransomware-as-a-service (RaaS)* and claiming it had breached **200+ organizations** in a very short period. Multiple investigations found the victim list and “leak” materials to be largely **non-credible**, including listings for apparently fictional entities and public denials from named organizations that they had been compromised. Researchers assessed the campaign as primarily designed to **create the illusion of mass breaches** to attract or defraud would-be affiliates rather than to extort confirmed victims. Technical review of 0APT’s infrastructure described an onion-based leak site and a RaaS panel that allowed affiliates to generate limited numbers of ransomware builds and advertised multi-platform targeting (including **Windows, Linux, and macOS**), with Windows payloads described as **Rust-based**. The “downloadable” leak content showed suspicious behavior—claimed dataset sizes that did not align with the presented file trees and downloads that failed to complete in practical time—along with a lack of preview evidence (e.g., screenshots) typically used by established ransomware groups to prove exfiltration. While the public-facing campaign appeared to be a **bluff**, researchers cautioned that the presence of functioning RaaS tooling could still enable the operators to evolve into a more operational threat if they successfully recruit affiliates.
Jun 29, 2026
Threat intelligence researchers reported that a newly surfaced actor calling itself **0APT/0apt** launched a dark web “leak site” and rapidly posted a large set of purported victims—mixing **real brand names with clearly fabricated entities**—which triggered incident-response activity at some named organizations. S-RM assessed the operation as an **impostor ransomware** effort, noting examples of obviously fictional victims (including names suggestive of LLM-generated or pop-culture-derived entities) and warning that the scale and sector spread of the claimed victim list is atypical even for major historical campaigns. Independent analysis cited by DataBreaches.net similarly concluded the “leaks” are **not stolen data**: downloads linked from the site reportedly produce **endless streams of random bytes** rather than exfiltrated files, consistent with piping a randomness source such as `/dev/random` to visitors. Both write-ups assess the activity as a **scam or deception operation**—potentially to pressure listed companies into paying, waste defenders’ time, or lure other criminals—advising organizations named on the site to **validate claims with due diligence** and respond proportionately rather than initiating large-scale technical remediation solely based on the postings.
Jul 8, 2026
Ransomware groups **0APT** and **KryBit** turned on each other in a public dark-web feud, with 0APT threatening to dox people tied to KryBit unless it was paid and publishing a sample of allegedly stolen KryBit files. Researchers cited in the reporting said the sample included plaintext credentials linked to KryBit operators and affiliates, plus five cryptocurrency wallet addresses, while 0APT also tried to lure KryBit victims by offering help recovering encrypted data. The clash expanded beyond threats when KryBit reportedly hacked 0APT, defaced its leak site, and exposed internal data from the rival operation. Analysis from Halcyon said the mutual leaks damaged both gangs, forcing infrastructure rebuilds and likely rebranding, while also undermining their credibility. Leaked 0APT access logs suggested its claims of more than 190 victims since launching in January were fabricated and that no victim data had been exfiltrated, while leaked KryBit negotiation data showed about 20 potential victims and ransom demands ranging from **$40,000** to **$100,000**. The dispute also touched **Everest Group**, whose encoded and hashed publication and user data was reportedly exposed, highlighting mounting pressure inside the ransomware ecosystem as falling crypto ransom revenues intensify competition among criminal groups.
Jun 29, 2026