Signalis
sign in--:--:--UTC
Threat actors

Krybit

☆ pin
Reports
75
First seen
May 15, 2026
Last seen
Aug 13, 2026
Motivation
Financial

Targeting

Sectors
Other ×13Government ×6Technology ×3Retail & E-commerce ×3Education ×3Manufacturing ×3Financial Services ×2Healthcare ×2
Victim regions
×2
×5
Mexico×5
Brazil×4
France×4
Singapore×3
India×3
South Africa×3
Taiwan×3
Bolivia×2

Victim country, only when stated. Corpus is predominantly English-language reporting, so US/EU coverage is overweighted relative to true victim distribution.

Top ATT&CK techniques

T1005 Data from Local System ×1T1486 Data Encrypted for Impact ×1T1190 Exploit Public-Facing Application ×1

Indicators

domain ×78ip_v4 ×2

Indicator values are available on Pro and via the API.

Recent reports

High

State of Ransomware Q2 2026: Concentration Shifts as Top Groups Dominate 57.6% of Victims

Check Point ResearchMedium

Krybit ransomware gang publishes hisstw.com as new victim

ransomware.liveHigh

Krybit ransomware gang publishes labindia.com as new victim

ransomware.liveHigh

Krybit ransomware gang publishes lhyk.com.sg as victim

ransomware.liveHigh

Krybit ransomware gang publishes Kilpi-Koskinen as victim

ransomware.liveHigh

Krybit ransomware gang publishes new victim: apsanet.com.ar

ransomware.liveHigh

Krybit ransomware gang publishes Studio Tibaldi as victim

ransomware.liveHigh

Krybit ransomware publishes victim reflet2000.fr

ransomware.liveHigh

Krybit ransomware gang publishes Actini as victim

ransomware.liveHigh

Krybit ransomware claims victim: ERNAT Bureau d'Études

ransomware.liveHigh

Krybit ransomware publishes Serengeti Estates as victim

ransomware.liveHigh

Krybit ransomware claims Mexican industrial hose manufacturer HYMIASA

ransomware.liveHigh

Krybit ransomware gang claims CESMAC victim

ransomware.liveHigh

Krybit ransomware gang publishes ProHealth Singapore as victim

ransomware.liveHigh

Krybit ransomware claims victim: DC Partner (South Africa)

ransomware.liveHigh

Krybit ransomware gang claims victim: ASA International (Nigeria)

ransomware.liveHigh

Krybit ransomware publishes Ville de Rinxent as victim

ransomware.liveHigh

Krybit ransomware gang claims Country Motors Mexico as victim

ransomware.liveHigh

Krybit ransomware gang publishes Buzz Trading as victim

ransomware.liveHigh

Krybit ransomware gang claims Nile Pet as new victim

ransomware.liveMedium

Krybit ransomware gang claims new victim: laxai.com

ransomware.liveMedium

Krybit ransomware claims new victim: chkck.com

ransomware.liveHigh

Krybit ransomware gang publishes dhli.in as victim

ransomware.liveHigh

Krybit ransomware gang publishes Vibonum Technologies as victim

ransomware.liveHigh

Krybit ransomware claims eurohold.bg victim

ransomware.liveHigh

Krybit ransomware gang publishes euroins.bg as victim

ransomware.liveHigh

Krybit ransomware publishes eitzchaim.com as victim

ransomware.liveHigh

Krybit publishes formasuniversales.com as new victim

ransomware.liveHigh

Krybit ransomware publishes rehabmalaysia.com as victim

ransomware.liveHigh

Krybit ransomware gang publishes Lagus as victim on ransomware.live

ransomware.live

This page shows data on a 7-day delay. Free accounts get the full delayed feed; real-time reports, indicators, and the API start at $29/mo.

Sign upSee plans