THREAT ACTOR
KRYBIT_
ActiveKRYBIT is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem: file encryption combined with the threat of stolen-data publication on a public leak site. It continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of KRYBIT, including incident write-ups, attribution notes and additional context, see the Threat Groups archive or run a site search.
Victims by year
- 2026 152
Leak site mirrors
4 mirrors tracked, 2 currently reachable. These are criminal-infrastructure URLs; links are deliberately not provided.
-
krybitxdpxohsmjooeb3gbgpmdddreh6mnflzac6bnezz74b7yje67yd.onionsnapshot · 2026-09-22 22:02 -
krybitx3fh5krdnhegyp2ob3lhizsaiadturtio3ginf7it5gsdgu2yd.onionsnapshot · 2026-09-22 22:00 -
krybitqsdzwmhnitvwuhvsntfgf2wrhxveyxroxpc44c6gkft2cqldyd.onionsnapshot · 2026-09-22 23:01 -
krybieodq754vlwufrsuxaswxb5zpxyibaawmed2jaduoz2e5m56hmid.onionsnapshot · 2026-09-22 23:31
Recent victims
The 50 most recent victims claimed by KRYBIT. Total in the index: 152.
| Date listed | Victim | Description |
|---|---|---|
| 2026-09-20 | acilnet.com | Ahluwalia Contracts (India) Limited (ACIL) is one of India's largest c… |
| 2026-09-18 | www.harputyapi.com | Harput Yapı is an Istanbul-based residential real estate developer and… |
| 2026-09-18 | www.diakonie-apolda.de | Diakoniewerk Apolda gGmbH is a German non-profit social welfare organi… |
| 2026-09-13 | www.kashkha.com | Kashkha is a multinational modest fashion brand founded three decades … |
| 2026-09-12 | www.tiflispalace.ge | Tiflis Palace is a luxurious boutique hotel located in the heart of Tb… |
| 2026-09-12 | www.tender.mx | Tender (Carnicería Tender) is a Mexican premium butcher shop chain (ca… |
| 2026-09-12 | capricornlogistics.com | Capricorn Logistics Pvt. Ltd. is an Indian comprehensive supply chain … |
| 2026-09-12 | www.ibnsinatrust.com | The Ibn Sina Trust is a pioneering Bangladeshi non-profit welfare trus… |
| 2026-09-12 | lasultanahotels.com | La Sultana Hotel Group is a Moroccan luxury boutique hotel group creat… |
| 2026-09-12 | eracm.fr | ERACM (École Régionale d'Acteurs de Cannes et Marseille) is a French n… |
| 2026-09-12 | pss.ht | Professional Security Services S.A. (PSS) is a Haitian-owned private s… |
| 2026-09-12 | www.metalware.ca | Metalware Corporation Inc. is Canada's leading industrial shelving man… |
| 2026-09-12 | intherpro.com | Intherpro LLC (International Thermal Insulation & Passive Fire Protect… |
| 2026-09-12 | meridian16.hr | Meridian 16 Business Park d.o.o. is a Croatian eco-industrial business… |
| 2026-09-12 | www.eac-airports.com | Egyptian Airports Company (EAC) is an Egyptian state-owned public comp… |
| 2026-09-12 | swadeshicipl.com | Swadeshi Civil Infrastructure Private Limited (SCIPL) is an Indian pri… |
| 2026-09-03 | ligacancerguate.org | INCAN — Instituto de Cancerología y Hospital Dr. Bernardo del Valle S.… |
| 2026-09-03 | incan.org.gt | INCAN — Instituto de Cancerología y Hospital Dr. Bernardo del Valle S.… |
| 2026-09-01 | seashellhospital.com | Seashell Hospital is a comprehensive private Egyptian hospital located… |
| 2026-09-01 | uicc.org | The Union for International Cancer Control (UICC) is the world's large… |
| 2026-09-01 | tum.com.mx | TUM Transportistas Unidos Mexicanos División Norte, S.A. de C.V. is th… |
| 2026-09-01 | www.alphaplantes.com | Alphaplantes (Service d'Entretien des Plantes Alpha Inc.) is a Canadia… |
| 2026-09-01 | reignwoodpark.com | Reignwood Park Thailand is a luxury real estate and integrated lifesty… |
| 2026-09-01 | orex.co.th | Orex Trading Co., Ltd. is a Thai trusted distributor and one-stop serv… |
| 2026-09-01 | amptc.net | Arab Maritime Petroleum Transport Company (AMPTC) is a leading Arab ma… |
| 2026-09-01 | dmt-group.com | DMT Consulting Private Limited is an Indian private limited company in… |
| 2026-09-01 | jswlaw.bt | Jigme Singye Wangchuck School of Law (JSW Law) is Bhutan's first and o… |
| 2026-09-01 | vedantaainstitute.in | Vedantaa Institute of Medical Sciences (VIMS) is a private Indian medi… |
| 2026-09-01 | meccahighfeed.blogspot.com | مصنع مكة وهاي فيد للأعلاف (Mecca High Feed Factory) is an Egyptian ani… |
| 2026-09-01 | transportesmontejo.com | Transportes Montejo S.A.S. is a Colombian specialized heavy transport … |
| 2026-09-01 | southsign.in | Southsign Technologies is an Indian proprietor firm established in 202… |
| 2026-09-01 | hccd-construction.com | The Holding Company for Construction and Development (HCCD) is an Egyp… |
| 2026-08-26 | sysconth.com | Syscon (Thailand) Co., Ltd. is a Thai company headquartered in Bang Kh… |
| 2026-08-26 | jindallifescience.com | Jindal Life Science Private Limited is an Indian full-service Contract… |
| 2026-08-26 | mimafoods.net | Mima Foods is an Egyptian top producer and global exporter of IQF (Ind… |
| 2026-08-26 | vascara.com | Vascara (Global Fashion One Member Company Limited) is a Vietnamese pr… |
| 2026-08-26 | www.neooftalmo.com.br | NEO — Núcleo de Excelência em Oftalmologia Ltda is a leading Brazilian… |
| 2026-08-26 | lemonfarm.com | Lemon Farm Co., Ltd. is a leading Thai organic supermarket chain and o… |
| 2026-08-26 | finodayacapital.com | Finodaya Capital Private Limited is an Indian tech-enabled Non-Banking… |
| 2026-08-26 | wmiemporium.com | WMI Emporium Co., Ltd. is a Thai manufacturer and distributor of metal… |
| 2026-08-26 | cgcgabon.com | Le Conseil Gabonais des Chargeurs (CGC) is a Gabonese public administr… |
| 2026-08-26 | karkinos.in | Karkinos Healthcare Private Limited is an Indian comprehensive cancer … |
| 2026-08-26 | ferretornillos.gt | Ferretornillos, S.A. is a Guatemalan company incorporated on March 14,… |
| 2026-08-26 | www.sankovn.com | Sanko Fastem (Vietnam) Co., Ltd. is a Vietnamese subsidiary of Sanko F… |
| 2026-08-24 | resi.com | Resi is a UK-based online architectural and home renovation platform f… |
| 2026-08-19 | sunsea.co.th | Sunsea Plastics P.S. Co., Ltd. is a Thai family-owned company establis… |
| 2026-08-19 | www.mestojilemnice.cz | Město Jilemnice (City of Jilemnice) is the official website of the mun… |
| 2026-08-19 | automotoresrosedal.com.ar | Rosedal Automotores S.R.L. is an Argentine company incorporated on Feb… |
| 2026-08-19 | sipresitalia.it | S.I.P.R.E.S. SRL (Società Italiana Progetti Ricerche e Sviluppo — Ital… |
| 2026-08-19 | www.hsi.info | hsi personaldienste hart & schenk GmbH is a German staffing and tempor… |
CONFIRMED ATTACKS
Krybit confirmed attacks: 8 verified incidents
Ransomnews has verified 8 Krybit incidents against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. The confirmed record runs from April 2026 to August 2026. Thailand accounts for 2 of them (25%), with victims recorded in 7 countries in total. The most affected sector is finance, at 2 confirmed victims. A ransom payment was publicly confirmed in 0 cases and publicly refused in 2; the outcome is unrecorded in the remaining 6.
Confirmed victims by year
Most affected sectors
Most affected countries
Verified Krybit incidents
| Date | Organisation | Sector | Location | Records | Ransom paid | Source |
|---|---|---|---|---|---|---|
| August 2026 | Instituto Nacional de Cancerología (INCAN) | Healthcare | Guatemala City, Guatemala | — | No | Source |
| August 2026 | Sanko Fastem (Vietnam) Co., Ltd. | Retail | Hanoi, Vietnam | — | Unknown | Source |
| August 2026 | DC Partner | Finance | George, South Africa | — | Unknown | Source |
| July 2026 | Eurohold Bulgaria AD (Euroins AD) | Finance | Sofia, Bulgaria | — | No | Source |
| June 2026 | Cour des Comptes du Sénégal | Government | Dakar, Senegal | — | Unknown | Source |
| May 2026 | Bangkok Metropolitan Administration | Government | Bangkok, Thailand | — | Unknown | Source |
| April 2026 | Unipest Co., Ltd. | Service | Nonthaburi, Thailand | — | Unknown | Source |
| April 2026 | The Church of Christ in China Kei To Secondary School | Education | Hong Kong, Hong Kong | — | Unknown | Source |
Claimed vs confirmed. The figures above the fold on this page come from Krybit's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design: most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.