TTPwire Vol. 1 · MITRE ATT&CK·Tagged

← All stories

Infosecurity Magazine

Ransomware Turf War as 0APT and KryBit Groups Trade Blows

2026-04-28 · Read original ↗

ATT&CK techniques detected

5 predictions
T1486Data Encrypted for Impact
97%
“ransomware turf war as 0apt and krybit groups trade blows two ransomware groups are licking their wounds and rebuilding their infrastructure after leaking each other ’ s operational data online, according to halcyon. the set - to began when 0apt claimed the scalps of three ransom…”
T1486Data Encrypted for Impact
88%
“. however, that seems to have backfired after krybit responded in kind. everest group thus far has not hit back at 0apt, despite having its encoded and hashed publication and user data leaked by the group. “ due to the extensive leaks of both krybit and 0apt, the operators will l…”
T1657Financial Theft
75%
“ransomware turf war as 0apt and krybit groups trade blows two ransomware groups are licking their wounds and rebuilding their infrastructure after leaking each other ’ s operational data online, according to halcyon. the set - to began when 0apt claimed the scalps of three ransom…”
T1491.001Internal Defacement
62%
“krybit responded by hacking back at 0apt, stealing data and defacing its leak site with the message : “ next time, don ’ t play with the big boys, ” according to the report. “ krybit leaked the full 0apt operational data set the following day, which included full access logs, php…”
T1486Data Encrypted for Impact
60%
“krybit responded by hacking back at 0apt, stealing data and defacing its leak site with the message : “ next time, don ’ t play with the big boys, ” according to the report. “ krybit leaked the full 0apt operational data set the following day, which included full access logs, php…”

Summary

Ransomware groups 0APT and KryBit have doxxed each other online