Loading story…
A new ransomware operation calling itself 0APT surfaced on dark web infrastructure in early 2026, promoting itself as a ransomware-as-a-service (RaaS) and claiming it had breached 200+ organizations in a very short period. Multiple investigations found the victim list and “leak” materials to be largely non-credible, including listings for apparently fictional entities and public denials from named organizations that they had been compromised. Researchers assessed the campaign as primarily designed to create the illusion of mass breaches to attract or defraud would-be affiliates rather than to extort confirmed victims.
Technical review of 0APT’s infrastructure described an onion-based leak site and a RaaS panel that allowed affiliates to generate limited numbers of ransomware builds and advertised multi-platform targeting (including Windows, Linux, and macOS), with Windows payloads described as Rust-based. The “downloadable” leak content showed suspicious behavior—claimed dataset sizes that did not align with the presented file trees and downloads that failed to complete in practical time—along with a lack of preview evidence (e.g., screenshots) typically used by established ransomware groups to prove exfiltration. While the public-facing campaign appeared to be a bluff, researchers cautioned that the presence of functioning RaaS tooling could still enable the operators to evolve into a more operational threat if they successfully recruit affiliates.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
A Barricade Cyber Solutions threat intelligence report published on 2026-04-13 describes a panel breach involving the Krybit ransomware operation and attributes the activity to 0APT. This represents a specific operational incident tied to 0APT beyond its earlier suspected bluff campaign.
Despite the apparent bluff campaign, investigators reported that 0APT's generated ransomware binaries appeared to be functional. Defenders were advised to verify breach claims through official channels and monitor for 0APT indicators of compromise.
By mid-February 2026, multiple researchers and security firms concluded that 0APT's victim claims were mostly fake, citing fabricated file trees, broken downloads, denials from named organizations, and at least one fictional victim. The findings suggested the operation was likely aimed at scamming would-be affiliates rather than reflecting genuine large-scale extortion activity.
Shortly after appearing, 0APT publicly claimed it had compromised over 200 victims within its first week of operation. The group used leak-site listings and purported victim data to project rapid success and attract affiliates.
In late January 2026, a purported ransomware group called 0APT emerged on dark web forums, advertising itself as a ransomware-as-a-service platform. It promoted infrastructure including a TOR leak site, affiliate panel, negotiation chat, and cross-platform ransomware builders.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
id-ransomware.blogspot.com
Open sourcebarricadecyber.com
Open sourcecybersecuritynews.com
Open sourcecyderes.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers assessed a purported ransomware operation calling itself **0APT** and found indicators it may be a scam rather than an active extortion group. The actor launched a data-leak site in late January and rapidly posted **200+ claimed victims** within about a week—an unusually high tempo that often suggests a rebrand or splinter group, prompting closer scrutiny by GuidePoint Security. Reporting indicates the 0APT narrative quickly unraveled after online observers flagged that many listed victims appeared **fake** (potentially AI-generated names). The group then took its leak site offline, later relaunching it with **a smaller list of real organizations**, but researchers said **none of the alleged compromises have been substantiated**; in at least two cases, organizations that conducted incident response investigations reportedly found **no evidence of a breach**. The operation also reportedly required a **bitcoin “joining fee” for affiliates**, reinforcing concerns that the brand is being used to monetize would-be partners rather than to conduct verified ransomware intrusions.
Jun 29, 2026
Threat intelligence researchers reported that a newly surfaced actor calling itself **0APT/0apt** launched a dark web “leak site” and rapidly posted a large set of purported victims—mixing **real brand names with clearly fabricated entities**—which triggered incident-response activity at some named organizations. S-RM assessed the operation as an **impostor ransomware** effort, noting examples of obviously fictional victims (including names suggestive of LLM-generated or pop-culture-derived entities) and warning that the scale and sector spread of the claimed victim list is atypical even for major historical campaigns. Independent analysis cited by DataBreaches.net similarly concluded the “leaks” are **not stolen data**: downloads linked from the site reportedly produce **endless streams of random bytes** rather than exfiltrated files, consistent with piping a randomness source such as `/dev/random` to visitors. Both write-ups assess the activity as a **scam or deception operation**—potentially to pressure listed companies into paying, waste defenders’ time, or lure other criminals—advising organizations named on the site to **validate claims with due diligence** and respond proportionately rather than initiating large-scale technical remediation solely based on the postings.
Jul 8, 2026
Krybit has emerged as a ransomware-as-a-service (**RaaS**) operation using **double extortion**, Tor-hosted leak infrastructure, and a likely **Babuk-derived** payload targeting **Windows, Linux, VMware ESXi, and NAS** environments. Reporting indicates the malware deletes shadow copies, appends the `.KRYBIT` extension to encrypted files, and drops a `RECOVER-README.txt` ransom note. The group has pursued broad, opportunistic victimization across **43 countries**, with **Germany, Spain, and Brazil** among the most affected geographies and professional services, technology, and manufacturing among the most targeted sectors. Public visibility into Krybit increased after rival RaaS operator **0APT** breached Krybit’s affiliate panel in April, exposing plaintext credentials, user roles, negotiation data, Tox IDs, and Bitcoin wallets, with leaked records showing about **20 victims** in active negotiations and ransom demands ranging from **$40,000 to $100,000**. Krybit retaliated by compromising and defacing 0APT’s leak site and publishing its operational data, creating a notable ransomware-on-ransomware conflict. Despite the reputational damage and evidence that no confirmed ransom payment had yet been recorded during the leaked period, Krybit continued naming victims through mid-2026 and showed no public signs of shutting down or rebranding.
Jul 13, 2026