Krybit

No sourced public emblem in this profile.

reference profile · reported nexus: Unknown (not nationality)

Krybit is a ransomware group that operates as a ransomware-as-a-service provider, offering affiliates 80% of ransom proceeds in exchange for technical support and a malware suite. The group has claimed attacks on various organizations across multiple countries, including asesoriauriel.com in Spain and fraper.com in Spain, without disclosing the volume of data exfiltrated. Krybit is currently engaged in a turf war with another group, 0APT, and has been accused of fabricating victim claims. Their leak site has been used to publish compromised data and to issue threats to rivals and victims alike.

Source-reported aliases: . Associations do not prove equivalence.

Target geography

Catalog-listed countries (associations, not attack counts): No country-level metadata

10 observed public claim posts in the collection window 2025-11-21 through 2026-10-25. Accumulated bounded samples: newest 1,000 records from each of the current and previous source years, refreshed every six hours. Historical gaps are not filled. These are not confirmed attacks or unique victims. Dates are provider record dates; countries are provider classifications; unknown is retained. Source: Ransomfeed — Dario Fadda · CC BY 4.0. Adapted into anonymous counts by Kinwilder; no endorsement implied.

France: 3 posts
India: 2 posts
Colombia: 1 posts
Egypt: 1 posts
Czech Republic: 1 posts
Singapore: 1 posts
Saudi Arabia: 1 posts