Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Enjoying ransomware.live? Help us keep tracking ransomware gangs and shipping new features. Support us

Krybit

Active RaaS
World map Statistics
Krybit is an emerging RaaS group that launched in late March 2026, offering affiliates an 80/20 revenue split with support for Windows, Linux, ESXi, and NAS device encryption, and became notable for a public feud with rival group 0APT in which each breached and leaked the other's operator data.
Victims
176
7 this month
Rank
#42 / 388
#12 over the last 12 months
First victim
2026-03-30
estimated attack date
Last victim
2026-11-12
3 days ago
Attack → claim
3.6 d
average delay
Countries
57
hit
Infostealer
48.9%
of victims with a domain
Leak-site uptime
8.9% average, 30 days

Victims per month

-56%
By estimated attack date when known, otherwise by discovery date.

Top sectors

  • Professional Services 29 · 16%
  • Technology 25 · 14%
  • Retail & E-Commerce 20 · 11%
  • Other 15 · 9%
  • Healthcare 15 · 9%
  • Manufacturing 13 · 7%
  • Transportation 9 · 5%
  • Education 8 · 5%
  • Financial Services 7 · 4%
  • Government & Defense 7 · 4%

Top countries

What ransomware.live knows about krybit