Signalis
sign in--:--:--UTC
Threat actors

Krybit

☆ pin
Reports
136
First seen
May 15, 2026
Last seen
Oct 4, 2026
Motivation
Financial

Targeting

Sectors
Other ×21Government ×7Healthcare ×7Technology ×5Retail & E-commerce ×5Education ×5Manufacturing ×5Transport & Logistics ×5
Victim regions
×3
×12
India×12
Mexico×7
France×7
United States×6
Brazil×5
Thailand×4
Czechia×3
Guatemala×3

Victim country, only when stated. Corpus is predominantly English-language reporting, so US/EU coverage is overweighted relative to true victim distribution.

Top ATT&CK techniques

T1005 Data from Local System ×1T1486 Data Encrypted for Impact ×1T1190 Exploit Public-Facing Application ×1

Indicators

domain ×146ip_v4 ×8hash_sha256 ×5hash_sha1 ×2hash_md5 ×1

Indicator values are available on Pro and via the API.

Recent reports

High

Krybit ransomware gang publishes Euroditel as victim

ransomware.liveHigh

Krybit ransomware gang publishes Superpack (Colombia) as victim

ransomware.liveHigh

Krybit ransomware gang publishes daralteb.com as victim

ransomware.liveHigh

Krybit ransomware gang claims victim: www.kres.cz

ransomware.liveHigh

Krybit ransomware claims victim: www.raajratna.com

ransomware.liveHigh

Krybit ransomware publishes new victim: Pierre Feu (pierrefeu.fr)

ransomware.liveMedium

Krybit ransomware gang publishes sai.org.in as victim

ransomware.liveHigh

Krybit ransomware gang publishes EURODITEL/RESOTELECOM as victim

ransomware.liveHigh

Krybit ransomware gang publishes Disk Precision Group as victim

ransomware.liveHigh

Krybit ransomware gang publishes efada.sa as victim

ransomware.liveHigh

Krybit ransomware group claims Air Tanzania compromise

ransomware.liveHigh

Krybit ransomware claims Jones the Grocer victim

ransomware.liveHigh

Krybit ransomware gang publishes acilnet.com as victim

ransomware.liveHigh

Krybit ransomware publishes Harput API as victim

ransomware.liveHigh

Krybit ransomware gang publishes Diakonie Apolda as victim

ransomware.liveMedium

Krybit ransomware claims victim: kashkha.com

ransomware.liveHigh

Krybit ransomware claims victim: Tiflis Palace

ransomware.liveHigh

Krybit ransomware gang publishes new victim: www.tender.mx

ransomware.liveHigh

Krybit ransomware gang publishes Capricorn Logistics as victim

ransomware.liveHigh

Krybit ransomware gang claims new victim: Ibn Sina Trust

ransomware.liveHigh

Krybit ransomware gang publishes La Sultana Hotels as victim

ransomware.liveHigh

Krybit ransomware gang publishes eracm.fr as victim

ransomware.liveMedium

Krybit ransomware gang publishes new victim: pss.ht

ransomware.liveHigh

Krybit ransomware gang publishes Metalware as victim

ransomware.liveHigh

Krybit ransomware gang publishes intherpro.com as victim

ransomware.liveHigh

Krybit ransomware gang publishes meridian16.hr as victim

ransomware.liveHigh

Krybit ransomware gang claims EAC Airports as victim

ransomware.liveHigh

Krybit ransomware publishes Swadeshi CIPL as victim

ransomware.liveHigh

Krybit ransomware claims Liga Cancer Guatemala as victim

ransomware.liveHigh

Krybit ransomware gang publishes Seashell Hospital as victim

ransomware.live

This page shows data on a 7-day delay. Free accounts get the full delayed feed; real-time reports, indicators, and the API start at $29/mo.

Sign upSee plans