// THREAT ACTOR
KRYPTOS_
DormantKRYPTOS is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem — file encryption combined with the threat of stolen-data publication on a public leak site — and continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of KRYPTOS — incident write-ups, attribution notes, and additional context — see the Threat Groups archive or run a site search.
Victims by year
- 2025 8
Leak site mirrors
1 mirror tracked, 0 currently reachable. These are criminal-infrastructure URLs — links are deliberately not provided.
-
kryptospnjzz7vfkr663bnqv3dxirmr3svo5zwq7cvu2wdfngujgknyd.onionKryptos snapshot · 2025-12-11 11:13
Recent victims
The 50 most recent victims claimed by KRYPTOS. Total in the index: 8.
| Date listed | Victim | Description |
|---|---|---|
| 2025-11-06 | Provincial Department of Health Services Sri Lanka | Health Services – 145 Institutions – 439 Field Clinic Centres – 850 Me… |
| 2025-10-24 | Adichunchanagiri Institute Of Technology | Educational Institute – 2500 Students – 150 Staff |
| 2025-10-10 | Mea████████████ | Architecture, Engineering & Design · Wisconsin, United States · 1,200 … |
| 2025-10-10 | Har██████ | Legal Services · Sydney, Australia · 250 Employees |
| 2025-10-10 | Nor█████████████ | Financial Services · Toronto, Canada · 450 Employees |
| 2025-10-08 | 🔒 Mea████████████ | Architecture, Engineering & Design · Wisconsin, United States · 1,200 … |
| 2025-10-08 | 🔒 Nor█████████████ | Financial Services · Toronto, Canada · 450 Employees https://nor█████… |
| 2025-10-08 | 🔒 Har██████ | Legal Services · Sydney, Australia · 250 Employees https://www.har███… |