Loading story…
Ransomware groups 0APT and KryBit turned on each other in a public dark-web feud, with 0APT threatening to dox people tied to KryBit unless it was paid and publishing a sample of allegedly stolen KryBit files. Researchers cited in the reporting said the sample included plaintext credentials linked to KryBit operators and affiliates, plus five cryptocurrency wallet addresses, while 0APT also tried to lure KryBit victims by offering help recovering encrypted data. The clash expanded beyond threats when KryBit reportedly hacked 0APT, defaced its leak site, and exposed internal data from the rival operation.
Analysis from Halcyon said the mutual leaks damaged both gangs, forcing infrastructure rebuilds and likely rebranding, while also undermining their credibility. Leaked 0APT access logs suggested its claims of more than 190 victims since launching in January were fabricated and that no victim data had been exfiltrated, while leaked KryBit negotiation data showed about 20 potential victims and ransom demands ranging from $40,000 to $100,000. The dispute also touched Everest Group, whose encoded and hashed publication and user data was reportedly exposed, highlighting mounting pressure inside the ransomware ecosystem as falling crypto ransom revenues intensify competition among criminal groups.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
Halcyon assessed that the mutual leaks harmed both 0APT and KryBit, forcing infrastructure rebuilds and likely rebranding. The report also noted Everest Group data had been leaked, though Everest had not retaliated at that time.
Data exposed during the feud showed KryBit administrator, affiliate, and victim negotiation records spanning late March to mid-April 2026. The leak referenced 20 potential victims and ransom demands ranging from $40,000 to $100,000.
Researchers reviewing the leaked sample said it contained plaintext credentials tied to KryBit operators and affiliates, along with five cryptocurrency wallet addresses. They also found no evidence that KryBit had received ransom payments.
0APT posted on its leak infrastructure that it would expose identities, photos, names, locations, and other details of people affiliated with KryBit unless paid. It also published a sample of allegedly stolen KryBit files and offered to help KryBit victims recover data.
KryBit struck back by compromising 0APT, defacing its leak site, and exposing 0APT internal data. Leaked access logs indicated 0APT's claimed 190-plus victims since January were fabricated and that no victim data had actually been exfiltrated.
At the start of the feud, 0APT publicly claimed it had compromised rival ransomware groups KryBit, RansomHouse, and Everest Group. This triggered a broader criminal-on-criminal conflict later documented by Halcyon.
0APT began operating in January 2026. Later reporting and Halcyon analysis described it as a legitimate ransomware threat with credible technical depth, though some early victim claims were likely exaggerated.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
infosecurity-magazine.com
Open sourcego.theregister.com
Open sourcetheregister.com
Open sourcetheravenfile.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Krybit has emerged as a ransomware-as-a-service (**RaaS**) operation using **double extortion**, Tor-hosted leak infrastructure, and a likely **Babuk-derived** payload targeting **Windows, Linux, VMware ESXi, and NAS** environments. Reporting indicates the malware deletes shadow copies, appends the `.KRYBIT` extension to encrypted files, and drops a `RECOVER-README.txt` ransom note. The group has pursued broad, opportunistic victimization across **43 countries**, with **Germany, Spain, and Brazil** among the most affected geographies and professional services, technology, and manufacturing among the most targeted sectors. Public visibility into Krybit increased after rival RaaS operator **0APT** breached Krybit’s affiliate panel in April, exposing plaintext credentials, user roles, negotiation data, Tox IDs, and Bitcoin wallets, with leaked records showing about **20 victims** in active negotiations and ransom demands ranging from **$40,000 to $100,000**. Krybit retaliated by compromising and defacing 0APT’s leak site and publishing its operational data, creating a notable ransomware-on-ransomware conflict. Despite the reputational damage and evidence that no confirmed ransom payment had yet been recorded during the leaked period, Krybit continued naming victims through mid-2026 and showed no public signs of shutting down or rebranding.
Jul 13, 2026
Ransomware operations are increasingly **industrialized**, shifting from simple file encryption to multi-stage extortion that combines **encryption**, **data theft/leak threats**, **DDoS**, and in some cases direct pressure on third parties such as customers, partners, or regulators. This “quadruple extortion” model has been associated with major groups including **ALPHV/BlackCat**, **CL0P**, and **LockBit**, reflecting a broader trend toward scalable, high-tempo campaigns designed to maximize coercion and revenue. At the same time, incident-response reporting indicates some **zero-day-driven, downstream mass data-theft extortion** campaigns—popularized by **CL0P** against widely used file-transfer platforms—are becoming less effective at driving payments, as organizations better understand that paying for “data suppression” does not remove notification obligations or meaningfully reduce litigation and re-extortion risk. Separately, GuidePoint assessed with high confidence that the new “**0APT**” leak site’s claimed victim list is largely **fabricated** (or recycled from other groups) and likely intended to enable opportunistic extortion, re-extortion, or affiliate fraud; organizations named by 0APT were advised to validate impact via concrete indicators (e.g., ransom note, encryption, direct communication) before treating the posting as evidence of compromise.
Jun 29, 2026
Researchers assessed a purported ransomware operation calling itself **0APT** and found indicators it may be a scam rather than an active extortion group. The actor launched a data-leak site in late January and rapidly posted **200+ claimed victims** within about a week—an unusually high tempo that often suggests a rebrand or splinter group, prompting closer scrutiny by GuidePoint Security. Reporting indicates the 0APT narrative quickly unraveled after online observers flagged that many listed victims appeared **fake** (potentially AI-generated names). The group then took its leak site offline, later relaunching it with **a smaller list of real organizations**, but researchers said **none of the alleged compromises have been substantiated**; in at least two cases, organizations that conducted incident response investigations reportedly found **no evidence of a breach**. The operation also reportedly required a **bitcoin “joining fee” for affiliates**, reinforcing concerns that the brand is being used to monetize would-be partners rather than to conduct verified ransomware intrusions.
Jun 29, 2026