THREAT OPS › Threat News › Dark Web Profile: Krybit Ransomware
Dark Web Profile: Krybit Ransomware
<h1>Dark Web Profile: Krybit Ransomware</h1> <p>Emerging from an increasingly crowded and combative ransomware ecosystem, Krybit Ransomware operates as a financially motivated, opportunistic Ransomware-as-a-Service (RaaS) threat. Within weeks of launch, the group found itself at the center of a public feud with a rival RaaS operator, a clash that exposed both sides’ internal infrastructure and lef
Attributed threat actors
- PlayG1040
MITRE ATT&CK techniques
- Boot or Logon Initialization ScriptsT1037
- Boot or Logon Autostart ExecutionT1547
- Application Layer ProtocolT1071
- Process InjectionT1055
- Remote ServicesT1021
- Command and Scripting InterpreterT1059
- Exfiltration Over C2 ChannelT1041
- Valid AccountsT1078
- Multi-Factor AuthenticationT1556.006
- Data Encrypted for ImpactT1486
- CredentialsT1589.001
- Ingress Tool TransferT1105
- Remote Desktop ProtocolT1021.001
- Inhibit System RecoveryT1490
- Valid AccountsAML.T0012
- Command and Scripting InterpreterAML.T0050
Indicators of compromise
- bc1ql2f3mhw6yxammrs9ufklpqf9qlcwrr85u72v4hbtc
- bc1q5fvym0l0vvzhenhynzduf3qyp85zjdsrn7j8jubtc
- bc1qznfsaeyd4j4mzcsgu2a4m0sj5pw6tvrx2vdsclbtc
- bc1q7uhjsc6qtx933v2wjgmevh63yssjvzfx7cegudbtc
- bc1qvd3ucrrgzq5eyay5xxn8jerjh669ua6qyz3urkbtc
- https://barricadecyber.com/threat-intelligence-report-krybit-ransomware-panel-breach-by-0apt/url
- moscati.orgdomain
- secran.comdomain
- bjgrupo.comdomain
- fraper.comdomain
- whiskey.co.jpdomain
- ccckeito.edu.hkdomain
Original source: https://socradar.io/blog/dark-web-profile-krybit-ransomware/