Krybit ransomware gang continues extortion operations after being hacked by rival group
The Krybit ransomware group remains active and is still extorting victims despite suffering a breach by a competing criminal outfit, according to security researcher Graham Cluley.
Key points
- Krybit is identified as a fast-growing ransomware gang that continues to extort victims.
- The group was previously hacked by a rival criminal organization.
- Krybit retaliated against the rival group after the breach occurred.
The Krybit ransomware gang continues to operate and extort victims despite being compromised by a rival criminal group, according to security researcher Graham Cluley. This ongoing activity highlights the resilience of the threat actor even after suffering a significant security breach from a competitor in the cybercrime ecosystem.
Cluley describes Krybit as a fast-growing ransomware gang that has managed to maintain its extortion campaigns. The group did not cease operations following the hack by a rival outfit. Instead, Krybit hit back against the attackers who breached their infrastructure, demonstrating a retaliatory capability.
Operational Context and Retaliation
The incident involving Krybit illustrates the volatile nature of ransomware groups competing for victims. According to Cluley’s report published on the Fortra blog, the gang was hacked by a rival entity. This breach did not result in the immediate dissolution of the group.
Krybit responded to the compromise by hitting back at the rival group. This counter-action suggests that the organization retained some level of operational control or resources after the initial breach. The group continues to engage in extortion activities against victims, indicating that their core business model remains intact.
Targeting and Extortion Methods
Cluley’s analysis outlines how Krybit works and who they have targeted. The gang is characterized by its rapid growth in the ransomware landscape. They actively pursue organizations for extortion purposes.
The report details the mechanics of their operations, providing insight into their targeting strategies. Victims are subjected to ongoing extortion attempts by the group. The fact that Krybit is still extorting victims means that organizations remain at risk of encountering their demands.
What should you do?
Security professionals should monitor for indicators of compromise associated with Krybit. Understanding the group’s methods helps in detecting active infections. Cluley’s article provides guidance on what organizations can do to protect themselves from this specific threat.
WATCH FOR:
- Signs of ongoing extortion attempts from known ransomware groups.
- Reports of rival groups hacking ransomware operators, which may lead to data leaks.
- Updates from security researchers regarding the operational status of active gangs.
What to do and how to stay safe: Krybit
- Review current backup strategies to ensure data can be restored without paying ransoms.
- Monitor threat intelligence feeds for new indicators related to Krybit or similar groups.
- Verify that incident response plans include steps for dealing with active extortion attempts.
- Educate staff on recognizing phishing attempts that may serve as initial entry points.
Step-by-step guide: Endpoint Detection and Response Examples: How EDR Stops Hidden Threats
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Is the Krybit ransomware group still active?
Yes, according to Graham Cluley, Krybit is still extorting victims despite being hacked by a rival group.
What happened to the Krybit ransomware gang?
The gang was hacked by a rival criminal organization, but they hit back and continue their operations.
Who wrote the report on Krybit ransomware?
Security researcher Graham Cluley wrote the report, which was published on the Fortra blog.
